CVE-2026-89935: iio: light: apds9306: fix PM reference leak in apds9306_read_data()
In the Linux kernel, the following vulnerability has been resolved:
iio: light: apds9306: fix PM reference leak in apds9306readdata()
apds9306readdata() calls pmruntimeresumeandget() but several error paths return directly without calling pmruntimeputautosuspend(), leaking the runtime PM reference and preventing the device from autosuspending.
Use PMRUNTIMEACQUIREAUTOSUSPEND() and PMRUNTIMEACQUIREERR() to automatically handle runtime PM reference release on all return paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What is the operational impact of the leak?
On affected error paths, a runtime PM reference is not released. This prevents the APDS9306 device from autosuspending.
When can the issue occur?
It occurs when apds9306_read_data() acquires a runtime PM reference with pm_runtime_resume_and_get() and subsequently returns through one of several error paths without calling pm_runtime_put_autosuspend().
How is the issue fixed?
The fix uses PM_RUNTIME_ACQUIRE_AUTOSUSPEND() and PM_RUNTIME_ACQUIRE_ERR() so that the runtime PM reference is released automatically on all return paths.