CVE-2026-89936: iio: dac: m62332: Fix regulator reference count imbalance
In the Linux kernel, the following vulnerability has been resolved:
iio: dac: m62332: Fix regulator reference count imbalance
m62332setvalue() enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because the regulator is reference counted, changing a channel directly from one non-zero value to another enables it more than once, while a later write of zero disables it only once. The reference count never returns to zero and the regulator is left enabled indefinitely.
Only enable the regulator on the transition from zero to non-zero, and only disable it on the transition from non-zero to zero, using the previously stored channel value to detect the edge. Balance the regulator on the I2C error path so the reference count stays consistent if the write fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel iio: dac: m62332to a version that resolves this vulnerability.Patch iio: dac: m62332: Fix regulator reference count imbalance - Configuration
Modify m62332_set_value() so the Vcc regulator is enabled only when the channel transitions from 0 to non-zero, and disabled only when transitioning from non-zero to 0; use the previously stored channel value to detect the edge, and ensure the regulator is enabled/disabled consistently on the I2C error path so the reference count does not become imbalanced.
m62332_set_value() (iio: dac: m62332) Vcc regulator enable/disable reference counting = Enable only on transition from zero to non-zero; disable only on transition from non-zero to zero using previously stored channel state; keep regulator reference count consistent on I2C error path
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel m62332 IIO DAC driver are affected when software writes channel values. The imbalance occurs when a channel is changed from one non-zero value to another and is later set to zero.
What is the practical impact?
The Vcc regulator reference count can remain above zero after the channel is set to zero, leaving the regulator enabled indefinitely. This is a resource and power-management issue rather than an attacker-controlled condition described in the available data.
What should be done if the fix cannot be applied immediately?
Avoid changing a channel directly between non-zero values where possible. Returning the channel to zero before setting another non-zero value avoids the specific repeated-enable sequence described.
How does the fix handle failed I2C writes?
The fix balances the regulator reference count on the I2C error path. This keeps the count consistent when a hardware write fails.