CVE-2026-64499: Linux Kernel Privilege Escalation Flaw

CVE-2026-64499 Overview

CVE-2026-64499 is a runtime power management (PM) reference leak in the Linux kernel's Industrial I/O (IIO) subsystem, specifically within the Texas Instruments ADS1119 analog-to-digital converter driver (ti-ads1119). The flaw resides in the ads1119_triggered_buffer_preenable() function, which calls pm_runtime_resume_and_get() to wake the device before initiating a conversion. When the subsequent i2c_smbus_write_byte() call fails, the function returns the error without releasing the acquired runtime PM reference. The matching postdisable callback never runs when preenable fails, causing the counter to remain elevated. The device may then remain runtime-active indefinitely, blocking correct power state transitions.

Critical Impact
The leaked runtime PM reference prevents the ADS1119 device from entering low-power states after an I2C transfer failure, resulting in unnecessary power consumption and potential resource state corruption on affected embedded Linux systems.

Affected Products

Linux kernel versions containing the ti-ads1119 IIO ADC driver prior to the fix
Embedded and industrial Linux systems using the Texas Instruments ADS1119 ADC
Distributions shipping stable kernels that have not yet backported the fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64499 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64499

Vulnerability Analysis

The vulnerability is a resource leak [CWE-772] in the Linux kernel IIO ADC driver for the Texas Instruments ADS1119. The ads1119_triggered_buffer_preenable() function is invoked when a triggered buffer capture begins. It first calls pm_runtime_resume_and_get() to increment the runtime PM usage counter and ensure the device is powered on. It then issues an I2C command via i2c_smbus_write_byte() to start the ADC conversion cycle.

If the I2C write fails, the original code returns the error directly. Because preenable failed, the IIO core never invokes the paired postdisable callback that would normally release the runtime PM reference. This leaves the usage counter permanently elevated, preventing the device from suspending. Over repeated failed capture attempts, the runtime PM subsystem accounting becomes inconsistent with the actual device state.

Root Cause

The root cause is an unbalanced runtime PM reference in an error path. The driver acquired a PM reference but did not release it when a downstream operation failed. The fix stores the i2c_smbus_write_byte() return value in ret and calls the appropriate pm_runtime_put variant before returning the error, restoring symmetry between get and put operations.

Attack Vector

This is a local reliability and power-management defect rather than a remotely exploitable flaw. Triggering requires conditions that cause i2c_smbus_write_byte() to fail during buffer preenable, such as bus contention, hardware faults, or induced I2C errors. There is no evidence of remote exploitability, and no CVSS score is currently assigned. Exploit availability is not reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. Refer to the upstream kernel commits for the exact source-level change.

Detection Methods for CVE-2026-64499

Indicators of Compromise

Repeated I2C transfer errors logged from the ti-ads1119 driver during buffer enable operations
ADS1119 devices remaining in runtime-active state despite no active IIO consumers
Elevated runtime_usage counters in /sys/bus/i2c/devices/<device>/power/ for the affected ADC

Detection Strategies

Audit kernel versions across embedded fleets to identify unpatched ti-ads1119 drivers using uname -r and distribution package metadata
Correlate dmesg output for IIO subsystem errors with unexpected power-state anomalies on ADS1119-equipped hardware
Monitor sysfs runtime PM attributes for devices that fail to transition to suspended after buffer capture terminates

Monitoring Recommendations

Collect kernel logs centrally and alert on repeated i2c_smbus_write_byte failures tied to the ADC driver
Track power consumption baselines on industrial devices to detect drift caused by stuck runtime-active peripherals
Include kernel version inventory in configuration management to identify hosts pending backport of the fix

How to Mitigate CVE-2026-64499

Immediate Actions Required

Apply the upstream stable kernel commits that add the missing pm_runtime_put on the I2C failure path in ads1119_triggered_buffer_preenable()
Update to a Linux stable release that includes the fix and rebuild or reinstall affected kernel packages
Reboot systems after applying the patched kernel to clear any leaked runtime PM references from prior operation

Patch Information

The fix is available in the following upstream Linux kernel commits: 6537f0810018, adf4bc07f814, f40292fb1939, and ffb2195921c3. The patch stores the I2C transfer result and drops the runtime PM reference on failure before returning the error code.

Workarounds

Where patching is not immediately possible, avoid triggering IIO buffer captures on ADS1119 devices under conditions known to cause I2C failures
Ensure I2C bus integrity through proper pull-up resistors, cable shielding, and reduced bus contention to minimize i2c_smbus_write_byte() failures
Unbind the ti-ads1119 driver on affected hardware if the ADC is not required for production workloads

bash

# Verify running kernel version and check for the fix
uname -r

# Inspect runtime PM state of ADS1119 devices
for dev in /sys/bus/i2c/drivers/ads1119/*/power/; do
  echo "$dev"
  cat "$dev/runtime_status" "$dev/runtime_usage" 2>/dev/null
done

# Unbind the driver as a temporary mitigation if the ADC is not in use
echo "<i2c-device-id>" | sudo tee /sys/bus/i2c/drivers/ads1119/unbind