CVE-2026-43355: Linux Kernel Privilege Escalation Flaw

CVE-2026-43355 Overview

CVE-2026-43355 is a memory leak vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem. The flaw resides in the bh1780 ambient light sensor driver under iio/light/bh1780.c. The driver fails to balance Power Management (PM) runtime reference counts on the error path. When pm_runtime_get_sync() succeeds but the subsequent read operation fails, the matching pm_runtime_put_autosuspend() call is skipped. This leaks runtime PM references and can prevent the device from entering low-power states.

The issue is tracked under [CWE-401] (Missing Release of Memory after Effective Lifetime) and affects local Linux systems running vulnerable kernel builds, including 7.0-rc1 through 7.0-rc3.

Critical Impact
A local user triggering repeated read failures on the bh1780 sensor can exhaust PM runtime references, resulting in device unavailability and potential kernel-level denial of service.

Affected Products

Linux Kernel 7.0-rc1
Linux Kernel 7.0-rc2
Linux Kernel 7.0-rc3

Discovery Timeline

2026-05-08 - CVE-2026-43355 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43355

Vulnerability Analysis

The vulnerability exists in the bh1780 IIO driver, which provides userspace access to the ROHM BH1780 ambient light sensor. The driver uses the Linux PM runtime framework to manage device power states. Each call to pm_runtime_get_sync() increments an internal reference counter and must be paired with pm_runtime_put_autosuspend() to decrement it.

In the affected code path, the driver acquires a PM runtime reference, performs an I2C read against the sensor, and only releases the reference if the read succeeds. When the I2C transaction returns an error, the function exits early without decrementing the counter. Over repeated failed reads, the counter grows unbounded, leaving the device permanently marked as active.

The consequence is a resource leak inside kernel state. The device cannot autosuspend, power management policies break, and the driver may refuse subsequent operations.

Root Cause

The root cause is incorrect error-path handling in the bh1780 read routine. The pm_runtime_put_autosuspend() call was placed after the error check rather than before it. Any failure in the sensor read path bypasses the cleanup, violating the symmetric get/put contract required by the Linux PM runtime API.

Attack Vector

Exploitation requires local access with privileges sufficient to read from the IIO sysfs or character device interfaces exposed by the bh1780 driver. An attacker who can repeatedly trigger I2C read failures, or who can cause transient I/O errors against the sensor, accumulates leaked PM runtime references. Remote exploitation is not possible because the attack vector is local and constrained to systems with the affected hardware and driver loaded.

The vulnerability cannot be exploited for code execution or information disclosure. Impact is limited to availability of the affected device and downstream PM behavior.

No public proof-of-concept exists, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.013%.

Detection Methods for CVE-2026-43355

Indicators of Compromise

Persistently elevated runtime_active_kids or non-zero runtime_usage counts in /sys/devices/.../power/ for the bh1780 device.
Kernel log entries showing repeated I2C read failures against the bh1780 sensor without matching autosuspend transitions.
The bh1780 device remaining in the active runtime PM status indefinitely despite no userspace consumers.

Detection Strategies

Audit loaded kernel modules with lsmod | grep bh1780 and verify the running kernel version against the patched commits.
Monitor /sys/kernel/debug/pm_runtime/ and related debugfs entries for reference count anomalies on IIO light sensors.
Correlate IIO subsystem error messages with sustained device wakelock states to identify leaks in progress.

Monitoring Recommendations

Centralize kernel logs (dmesg, journalctl -k) and alert on repeated bh1780 read errors from embedded or mobile fleets.
Track kernel package versions across Linux endpoints to confirm patched builds are deployed.
For systems running the Singularity Platform agent on Linux, use telemetry from the single lightweight agent to inventory kernel versions across the fleet and surface hosts running vulnerable 7.0-rc builds.

How to Mitigate CVE-2026-43355

Immediate Actions Required

Update the Linux kernel to a build containing one of the upstream fixes: 1eb3af4, 33661bf, 424bf90, aae572d, dd72e6c, or fc77e0a.
Inventory devices that ship with the ROHM BH1780 ambient light sensor and prioritize them for patching.
Restrict local access to systems exposing the affected sensor through IIO sysfs entries until patches are applied.

Patch Information

The fix moves pm_runtime_put_autosuspend() before the error check in the bh1780 driver, ensuring the PM runtime reference count is decremented whether the read operation succeeds or fails. The patch has been backported across multiple stable kernel trees as referenced by the six git.kernel.org commits above. Distribution maintainers have integrated these commits into their respective stable updates.

Workarounds

Unload the bh1780 module with rmmod bh1780 on systems where the sensor is not required.
Blacklist the driver via /etc/modprobe.d/blacklist-bh1780.conf to prevent automatic loading on boot.
Restrict permissions on /sys/bus/iio/devices/ entries corresponding to the bh1780 sensor to limit which local users can trigger reads.

bash

# Blacklist the vulnerable driver until kernel patch is applied
echo "blacklist bh1780" | sudo tee /etc/modprobe.d/blacklist-bh1780.conf
sudo rmmod bh1780 2>/dev/null

# Verify the module is no longer loaded
lsmod | grep bh1780