CVE-2026-23283: Linux Kernel Privilege Escalation Flaw

CVE-2026-23283 Overview

CVE-2026-23283 is a power management (PM) runtime reference leak in the Linux kernel fp9931 regulator driver. The flaw resides in the fp9931_hwmon_read() function. When regmap_read() returns an error, the function exits without calling pm_runtime_put_autosuspend(), leaving an unbalanced PM runtime reference. Repeated failures gradually exhaust the device's PM runtime counter, preventing the device from entering low-power states.

The issue has been resolved in the upstream Linux kernel through patches committed to the stable tree. The vulnerability has a low EPSS score, reflecting limited exploit potential.

Critical Impact
Repeated error paths in fp9931_hwmon_read() leak PM runtime references, which can prevent the regulator device from suspending and may lead to resource exhaustion on affected systems.

Affected Products

Linux kernel versions containing the fp9931 regulator driver prior to the fix
Stable kernel branches receiving the backported patches
Embedded systems and devices integrating the FP9931 regulator hardware

Discovery Timeline

2026-03-25 - CVE-2026-23283 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23283

Vulnerability Analysis

The vulnerability is a resource management defect classified as a reference count leak within the Linux kernel regulator subsystem. The fp9931_hwmon_read() function reads hardware monitoring values from the FP9931 regulator over a regmap interface. Before performing the read, the function acquires a PM runtime reference using a pm_runtime_get call so the device remains active.

The function must release that reference with pm_runtime_put_autosuspend() on every exit path. The error-handling branch for a failed regmap_read() returns the error code directly without releasing the reference. Each failed read therefore leaves the PM runtime usage counter incremented by one.

Over time, the device cannot autosuspend because its usage count never returns to zero. This produces increased power consumption and may interfere with downstream PM operations that depend on the device entering a quiescent state.

Root Cause

The root cause is missing cleanup on an error branch. The fix adds the required pm_runtime_put_autosuspend() call before returning the error from regmap_read(), restoring symmetry between the get and put operations.

Attack Vector

This is a local reliability defect rather than a remotely exploitable flaw. Triggering the leak requires conditions that cause regmap_read() to fail repeatedly, such as bus errors, hardware faults, or driver state inconsistencies. There is no known remote attack vector and no public exploit. The issue primarily impacts system stability and power management correctness.

The vulnerability is described in the upstream commit log. See the Kernel Git Commit Log and the companion stable backport commit for the source-level changes.

Detection Methods for CVE-2026-23283

Indicators of Compromise

Devices bound to the fp9931 regulator driver that fail to enter runtime suspend despite being idle
Elevated kernel log entries from regmap_read failures associated with the FP9931 device
PM runtime usage counters in /sys/devices/.../power/runtime_usage that grow monotonically without corresponding put operations

Detection Strategies

Audit running kernel versions against the fixed commits in the stable tree to confirm whether the patch is applied
Inspect /sys/kernel/debug/pm_genpd/ and per-device power/ sysfs entries for stuck active states on FP9931-backed regulators
Correlate regmap error messages in dmesg with subsequent PM runtime status changes on the same device

Monitoring Recommendations

Track kernel package versions across the fleet and flag systems running unpatched stable kernels
Monitor power consumption telemetry on embedded devices using the FP9931 regulator for sustained increases
Alert on repeated regulator subsystem errors in centralized log collection pipelines

How to Mitigate CVE-2026-23283

Immediate Actions Required

Update affected systems to a Linux kernel build that includes commits 0902010c8d16 and ada571018d54
Identify all hardware platforms that depend on the fp9931 regulator driver and prioritize their patch deployment
Validate that runtime PM behavior returns to baseline after applying the fix by checking device suspend transitions

Patch Information

The fix has been merged upstream and backported to stable branches. The relevant patches are available in the mainline commit and the stable backport. Distribution kernels should pick up the fix in their next stable kernel rebase.

Workarounds

If patching is not immediately possible, avoid workloads that repeatedly invoke hwmon reads against an unstable FP9931 device
Disable hwmon polling on affected regulators where the functionality is non-essential
Reboot affected systems periodically to reset leaked PM runtime references until the patch is applied

bash

# Verify the installed kernel includes the fix
uname -r
zgrep -i 'fp9931' /proc/config.gz
dmesg | grep -i 'fp9931\|regmap_read'