CVE-2026-89934iio: light: ltrf216a: fix runtime PM reference leak in error path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iio: light: ltrf216a: fix runtime PM reference leak in error path ltrf216a_get_lux() acquires a runtime PM reference by calling ltrf216a_set_power_state(data, true). However, if ltrf216a_read_data() fails, the function returns immediately without dropping the reference. This leaves the runtime PM usage count unbalanced, preventing the device from autosuspending after a failed read. Fix this by releasing the runtime PM reference before returning from the error path.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f before c4f003d8578f5718fe1ec332bc89f9ff69fd205b; from 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f before 0614928a3eda35bddd8c2f02311e286b59bbe746; 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f builds before 80e7381e8cccb543397572af153865f34aaf4353; from 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f before c132aef0e757a39036b1d40faf0569f2e343b13e | CNA record |
References
- https://git.kernel.org/stable/c/c4f003d8578f5718fe1ec332bc89f9ff69fd205b
- https://git.kernel.org/stable/c/0614928a3eda35bddd8c2f02311e286b59bbe746
- https://git.kernel.org/stable/c/80e7381e8cccb543397572af153865f34aaf4353
- https://git.kernel.org/stable/c/c132aef0e757a39036b1d40faf0569f2e343b13e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.