CVE-2026-64493 Overview
CVE-2026-64493 is a resource management flaw in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the mpl115 pressure sensor driver. The mpl115_read_raw() function acquires a runtime power management reference through pm_runtime_get_sync() before reading processed pressure or raw temperature values. On the read error path, the function returns without releasing that reference via pm_runtime_put_autosuspend(). Each failed read leaks a runtime PM reference and prevents the device from entering autosuspend. The upstream fix rebalances the reference count so both success and error paths release the acquired reference.
Critical Impact
Repeated read failures leak runtime PM references, keeping the mpl115 pressure sensor powered on indefinitely and degrading device power management.
Affected Products
- Linux kernel with the IIO mpl115 pressure sensor driver enabled
- Systems using Freescale MPL115 pressure sensors over I2C or SPI
- Embedded and IoT platforms shipping stable kernel branches prior to the patched commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64493 published to the National Vulnerability Database (NVD)
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64493
Vulnerability Analysis
The mpl115 driver exposes pressure and temperature channels through the IIO framework. When userspace reads a channel, mpl115_read_raw() calls pm_runtime_get_sync() to power up the sensor. The function then invokes the underlying I2C or SPI read routine.
When that low-level read returns an error, the original code path returns immediately with the error code. It never calls pm_runtime_put_autosuspend() to release the reference it acquired. The runtime PM subsystem tracks these references as a usage count, so each failed read increments the count without a matching decrement.
Over time, the sensor's usage count grows without bound. The kernel considers the device active and skips autosuspend transitions. This keeps the sensor powered on and consuming energy even when no consumer holds a legitimate reference.
Root Cause
The root cause is an unbalanced runtime PM reference in the read error path of mpl115_read_raw(). This is a classic resource leak pattern where an acquired resource is not released on all control-flow exits. The fix moves the pm_runtime_put_autosuspend() call before the return-value check, ensuring both success and error paths release the reference symmetrically.
Attack Vector
Exploitation requires the ability to trigger read failures on the sensor from within the running kernel. The attack surface is local and constrained to systems with the mpl115 driver bound to a physical device. The impact is limited to power management degradation and reference-count accounting rather than memory corruption or privilege escalation.
The vulnerability is functionally a denial of service against the device's power-saving behavior. See the Linux kernel commit fbe67ff37a6f for the corrected reference handling.
Detection Methods for CVE-2026-64493
Indicators of Compromise
- Elevated runtime PM usage counts for mpl115 devices visible under /sys/bus/i2c/devices/*/power/runtime_usage
- Sensor devices remaining in the active state indefinitely in /sys/.../power/runtime_status despite no active IIO consumers
- Repeated read errors in kernel logs referencing mpl115 alongside sustained higher power draw
Detection Strategies
- Audit installed kernel versions against the patched stable commits referenced in the NVD entry to confirm exposure
- Monitor IIO channel read error rates on systems using MPL115 pressure sensors and correlate with device autosuspend transitions
- Compare runtime PM usage counters against expected consumer counts for pressure sensor devices
Monitoring Recommendations
- Collect dmesg output filtered for mpl115 read failures and forward to a centralized log platform
- Track sysfs power-management attributes for IIO devices as part of embedded-system health telemetry
- Alert when sensor devices report active power state for extended periods without corresponding IIO reader processes
How to Mitigate CVE-2026-64493
Immediate Actions Required
- Update affected Linux kernels to a stable release containing the fix commits listed in the NVD advisory
- Inventory embedded and IoT assets that ship with the mpl115 driver enabled and prioritize their kernel updates
- If patching is delayed, unbind the mpl115 driver on systems where the sensor is not required
Patch Information
The fix is available in multiple stable branches through the following upstream commits: 46e69d3dd429, 5022f4ed5aae, aab0fed636b1, b3f1af4ba8e9, and fbe67ff37a6f. The patch relocates pm_runtime_put_autosuspend() so both success and error paths release the reference.
Workarounds
- Disable the mpl115 module on systems that do not require pressure sensor readings using modprobe -r mpl115 or blacklisting
- Restrict access to the IIO sysfs channel entries to trusted processes to reduce the frequency of failing reads
- Reboot affected systems periodically to reset accumulated runtime PM reference counts until a patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
