CVE-2026-98657: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
In the Linux kernel, the following vulnerability has been resolved:
iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure
pmruntimesetactive() failing in probe() jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup() -- it does not undo the iiodeviceregister() that already succeeded a few lines above. probe() then returns the error, the devm-managed indiodev is freed, but the iio core still has it registered: the sysfs/chardev nodes stay live and point at freed memory.
Add an errorunregdev label that unregisters the iio device before falling through to the existing buffer cleanup, mirroring the teardown order already used in lidarremove().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the iio: proximity: pulsedlight probe() error path, add an error_unreg_dev label that calls iio_device_unregister() before falling through to the existing buffer cleanup, so the iio device is unregistered when pm_runtime_set_active() fails.
Event History
Frequently Asked Questions
Under what condition can this issue occur?
It occurs when the driver probe has successfully registered the IIO device but pm_runtime_set_active() subsequently fails. The failed probe then frees the devm-managed device while its IIO registration remains active.
What is exposed if the failure occurs?
The registered sysfs and character-device nodes can remain live while pointing to freed memory. This leaves stale IIO interfaces after the driver probe returns an error.
How can the affected state be identified?
Look for a failed probe caused by pm_runtime_set_active() together with IIO sysfs or character-device nodes that remain present for the device. The condition is specifically an IIO device registration that was not undone during that probe failure.
What is the remediation?
Apply the fix that unregisters the IIO device on the PM setup error path before performing triggered-buffer cleanup. The corrected teardown order mirrors the existing lidar_remove() cleanup sequence.