CVE-2026-64494 Overview
CVE-2026-64494 is a runtime power management (PM) reference leak in the Linux kernel's Industrial I/O (IIO) light sensor driver for the Sharp GP2AP002 proximity and ambient light sensor. The gp2ap002_read_raw() function calls pm_runtime_get_sync() before reading the lux value, but returns directly when gp2ap002_get_lux() fails. This skips the pm_runtime_put_autosuspend() call at the out label, permanently leaking a runtime PM reference and preventing the device from autosuspending.
Critical Impact
Repeated read errors leak runtime PM references, keeping the sensor powered indefinitely and preventing device autosuspend, which increases power consumption on affected systems.
Affected Products
- Linux kernel versions containing the gp2ap002 IIO light sensor driver
- Systems using the Sharp GP2AP002 proximity and ambient light sensor
- Distributions shipping kernels prior to the fixes referenced in the kernel.org stable commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64494 published to the National Vulnerability Database (NVD)
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64494
Vulnerability Analysis
The vulnerability resides in drivers/iio/light/gp2ap002.c within the gp2ap002_read_raw() function. The function is responsible for handling read requests from userspace against the sensor's IIO channels. Before reading sensor data, the driver acquires a runtime PM reference through pm_runtime_get_sync() to ensure the device is powered on.
On the success path, control flows to the out label where pm_runtime_mark_last_busy() and pm_runtime_put_autosuspend() release the PM reference. However, when gp2ap002_get_lux() returns an error, the original code returns directly from the function, bypassing the cleanup label. Each failed read therefore increments the runtime PM usage counter without a matching decrement.
Once the counter is imbalanced, the PM core cannot autosuspend the device because it appears to have active users. The sensor remains powered indefinitely, wasting energy on battery-powered systems and blocking correct suspend behavior. The fix replaces the direct error return with a goto out statement so the cleanup path always executes.
Root Cause
The root cause is an unbalanced runtime PM reference count caused by an early return on the error path of gp2ap002_read_raw(). This is a classic resource leak pattern where a _get operation is not paired with a _put operation along every possible exit path.
Attack Vector
The attack vector is local. A user or process with access to the sensor's sysfs or IIO character device interface can trigger reads that fail in gp2ap002_get_lux(). Repeated failing reads incrementally leak PM references until the device is permanently kept awake. The condition is not remotely exploitable and does not yield code execution or privilege escalation.
The vulnerability manifests entirely within kernel driver error-handling logic. See the kernel.org stable commits, including Kernel Git Commit 0c655d067 and Kernel Git Commit 2593f0c6e, for the exact patch content.
Detection Methods for CVE-2026-64494
Indicators of Compromise
- Devices using the gp2ap002 driver that fail to enter autosuspend after userspace IIO reads.
- Non-zero, monotonically increasing runtime_active_kids or runtime_usage values in /sys/devices/.../power/ for the sensor after failed reads.
- Elevated power consumption on mobile or embedded devices shipping the Sharp GP2AP002 sensor.
Detection Strategies
- Audit kernel version and patch level against the stable kernel commits referenced in the NVD advisory to confirm the fix is present.
- Instrument test workloads that force gp2ap002_get_lux() failures and inspect runtime PM counters via sysfs to identify imbalanced references.
- Review vendor board support package (BSP) trees for backports of the fix, particularly on Android and embedded Linux images.
Monitoring Recommendations
- Monitor /sys/kernel/debug/pm_genpd/ and per-device power/runtime_status entries for devices stuck in the active state.
- Track battery drain regressions on devices known to include the GP2AP002 sensor after kernel updates.
- Include kernel package inventory in configuration management to detect unpatched hosts across the fleet.
How to Mitigate CVE-2026-64494
Immediate Actions Required
- Update to a Linux kernel that includes the upstream fix for the gp2ap002 runtime PM leak.
- Rebuild and redeploy custom or embedded kernels with the referenced stable commits cherry-picked.
- Validate that IIO light sensor reads followed by induced errors no longer prevent device autosuspend.
Patch Information
The fix replaces the direct error return in gp2ap002_read_raw() with a goto out so that pm_runtime_put_autosuspend() executes on every exit path. Patched commits are available across multiple stable branches, including Kernel Git Commit 29137052c, Kernel Git Commit 2ebaea7f3, Kernel Git Commit 38b72267b, Kernel Git Commit 62e0d7482, Kernel Git Commit 7110201c6, and Kernel Git Commit f350883989. Apply the version corresponding to the deployed kernel series.
Workarounds
- If patching is not immediately feasible, unbind the gp2ap002 driver on systems that do not require the sensor to prevent leaked references from accumulating.
- Restrict access to the IIO sysfs and character device interfaces to trusted processes only, reducing the chance of triggering repeated failing reads.
- Reboot affected devices periodically to reset leaked runtime PM references until a patched kernel can be deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
