CVE-2026-45883: Linux Kernel Resource Leak Vulnerability

CVE-2026-45883 Overview

CVE-2026-45883 is a resource leak vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the sca3000 accelerometer driver. The flaw resides in the sca3000_probe() function. The interrupt requested through request_threaded_irq() against spi->irq is not released when a subsequent call to iio_device_register() fails. This leaves the IRQ allocated without a corresponding owner, leading to a resource leak during driver initialization failure paths.

Critical Impact
Failed probe of the sca3000 SPI device leaves the requested IRQ resource unreleased, which can destabilize the IIO subsystem and the kernel driver state on affected platforms.

Affected Products

Linux kernel versions containing the unpatched sca3000 IIO driver prior to the fix commits
Systems using the SCA3000 SPI accelerometer driver in the IIO subsystem
Stable kernel branches addressed by the referenced upstream commits

Discovery Timeline

2026-05-27 - CVE-2026-45883 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45883

Vulnerability Analysis

The defect is a resource management error in the probe path of the sca3000 driver located in the IIO accelerometer subsystem. During initialization, the driver calls request_threaded_irq() to register a threaded interrupt handler against spi->irq. The driver then invokes iio_device_register() to register the IIO device with the kernel. The original code did not check the return value of iio_device_register() and did not free the previously registered IRQ when that registration failed. This left a stale handler bound to the IRQ line after probe failure. The upstream patches add a return value check and a common error handler to release the IRQ on failure.

Root Cause

The root cause is missing error-path cleanup [CWE-772 class: Missing Release of Resource]. The probe function acquired an IRQ resource but lacked a goto-based unwind that released it when subsequent initialization steps failed.

Attack Vector

The issue is triggered by failures during driver probe, not by a remote network vector. Repeated probe failures, induced by faulty hardware, malformed device tree entries, or controlled probe deferral conditions, accumulate orphaned IRQ resources and may impair driver reload or system stability.

No verified public exploit code is associated with CVE-2026-45883. Technical details are available in the upstream fix commits referenced below.

Detection Methods for CVE-2026-45883

Indicators of Compromise

Kernel log messages indicating sca3000 probe failure followed by IIO registration errors
Persistent entries for the sca3000 IRQ in /proc/interrupts after a failed device probe
Driver reload failures citing Device or resource busy when re-binding the sca3000 driver

Detection Strategies

Audit running kernel versions across Linux fleets and compare against patched stable releases referenced by the upstream commits
Inspect kernel ring buffer output via dmesg for iio_device_register failure messages associated with the sca3000 driver
Track changes in /proc/interrupts after IIO driver bind and unbind cycles to identify leaked IRQ lines

Monitoring Recommendations

Centralize kernel log collection from Linux endpoints and embedded systems using IIO sensors
Alert on repeated probe failure patterns for IIO drivers, which can indicate resource leak conditions
Include kernel version inventory checks in routine vulnerability scans for Linux hosts and IoT devices

How to Mitigate CVE-2026-45883

Immediate Actions Required

Update affected Linux kernels to a stable release containing one of the upstream fix commits
Identify systems that load the sca3000 IIO driver and prioritize them for patching
Reboot impacted systems after kernel updates to ensure the patched driver is active

Patch Information

The fix adds a return value check for iio_device_register() and a common error handler that releases the previously requested IRQ on failure. The patches are available in the following upstream kernel commits: Kernel Commit 103ac8e3, Kernel Commit 40c860ec, Kernel Commit 517d9f2b, Kernel Commit 55e13abf, Kernel Commit 597d749c, Kernel Commit 62b44ebc, Kernel Commit 84d3c396, and Kernel Commit e8e960c3.

Workarounds

Disable the sca3000 driver via kernel configuration on systems that do not require SCA3000 accelerometer support
Blacklist the module using /etc/modprobe.d/ entries until the patched kernel can be deployed
Avoid repeated driver bind and unbind cycles on systems with hardware that triggers probe failures

bash

# Configuration example: blacklist the sca3000 module until patching
echo "blacklist sca3000" | sudo tee /etc/modprobe.d/blacklist-sca3000.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep sca3000