CVE-2026-23283: Linux Kernel PM Runtime Leak Vulnerability

CVE-2026-23283 Overview

A Power Management (PM) runtime reference leak vulnerability has been identified in the Linux kernel's FP9931 voltage regulator driver. The flaw exists within the fp9931_hwmon_read() function, where a failed regmap_read() operation causes the function to return an error code without properly releasing the PM runtime reference by calling pm_runtime_put_autosuspend(). This resource management error can lead to system instability and potential denial of service conditions.

Critical Impact

Improper PM reference handling can prevent devices from entering low-power states, leading to resource exhaustion and system instability in embedded Linux systems utilizing the FP9931 regulator.

Affected Products

• Linux kernel with FP9931 regulator driver enabled
• Embedded systems using FP9931 voltage regulator
• Hardware monitoring subsystem (hwmon) implementations with FP9931 support

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23283 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23283

Vulnerability Analysis

The vulnerability is classified as a Memory Leak affecting the Linux kernel's regulator subsystem. The FP9931 driver implements hardware monitoring functionality through the hwmon interface, which requires proper PM runtime reference counting to manage device power states.

When fp9931_hwmon_read() is invoked to retrieve sensor data, the function acquires a PM runtime reference to ensure the device is powered and accessible. Under normal operation, after reading the data, the function should release this reference via pm_runtime_put_autosuspend(). However, when regmap_read() encounters an error condition, the error handling path returns immediately without releasing the acquired PM reference.

This oversight results in a persistent reference count increment that is never balanced by a corresponding decrement. Over time or with repeated failed read operations, the accumulated leaked references prevent the PM subsystem from transitioning the device to low-power states.

Root Cause

The root cause is improper error handling in the fp9931_hwmon_read() function. The function fails to call pm_runtime_put_autosuspend() in the error path when regmap_read() fails. This violates the PM runtime reference counting contract, which requires that every pm_runtime_get_*() call be paired with a corresponding pm_runtime_put_*() call, regardless of the execution path taken.

Attack Vector

The attack vector is local and requires the ability to trigger hardware monitoring read operations on a system with the FP9931 regulator driver loaded. An attacker or faulty hardware condition that causes repeated regmap_read() failures could exploit this vulnerability to:

1. Prevent the system from entering power-saving states
2. Exhaust kernel resources through accumulated reference counts
3. Cause system instability in resource-constrained embedded environments

The vulnerability description and fix can be reviewed in the kernel commit fix and kernel commit update.

Detection Methods for CVE-2026-23283

Indicators of Compromise

• Unexpected PM runtime reference counts on FP9931 devices visible in /sys/kernel/debug/pm_runtime/
• Device unable to enter low-power suspend states
• Kernel log messages indicating PM reference count imbalance
• Elevated power consumption on affected embedded systems

Detection Strategies

• Monitor PM runtime status through debugfs interfaces for abnormal reference counts
• Implement kernel runtime PM debugging with CONFIG_PM_RUNTIME_DEBUG enabled
• Use static analysis tools to audit PM reference counting in kernel drivers
• Deploy SentinelOne Singularity XDR for real-time kernel anomaly detection

Monitoring Recommendations

• Enable kernel PM runtime debugging to track reference count changes
• Monitor system power states for unexpected wake-lock behavior
• Implement automated alerts for hwmon subsystem errors in system logs
• Review dmesg output for regmap read failures on FP9931 devices

How to Mitigate CVE-2026-23283

Immediate Actions Required

• Update to the latest stable Linux kernel version containing the fix
• If unable to update immediately, consider disabling hwmon functionality for FP9931 if not required
• Monitor affected systems for signs of resource exhaustion
• Review system logs for evidence of exploitation attempts

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that pm_runtime_put_autosuspend() is called in all code paths, including the error path when regmap_read() fails.

Official patch commits are available at:

• Kernel Commit Fix
• Kernel Commit Update

Workarounds

• Disable FP9931 hwmon support if hardware monitoring is not required for your deployment
• Implement userspace monitoring to detect and respond to PM reference leaks
• Consider using alternative regulator drivers if available for your hardware platform
• Apply vendor-specific kernel patches if your distribution has not yet merged the upstream fix

# Check current PM runtime status for FP9931 devices
cat /sys/kernel/debug/pm_runtime/* | grep -i fp9931

# Verify kernel version includes the fix
uname -r

# Monitor for regmap errors in kernel logs
dmesg | grep -i "fp9931\|regmap"