CVE-2026-64503 Overview
CVE-2026-64503 is a Linux kernel vulnerability in the Industrial I/O (IIO) accelerometer driver for the Kionix KXSD9 sensor. The flaw resides in the kxsd9_write_raw() function, which acquires a runtime Power Management (PM) reference through pm_runtime_get_sync() but returns -EINVAL directly when a scale value with a non-zero integer part is requested. The early return skips the matching pm_runtime_put_autosuspend() call. Each invalid write leaks a runtime PM usage-counter reference, preventing the device from entering autosuspend and causing sustained power consumption on affected hardware.
Critical Impact
A local user issuing repeated invalid scale writes to the KXSD9 accelerometer sysfs interface can prevent runtime power management from suspending the device, resulting in an energy denial-of-service condition on battery-powered systems.
Affected Products
- Linux kernel iio/accel/kxsd9 driver (Kionix KXSD9 accelerometer)
- Multiple stable kernel branches receiving backports (see referenced Git commits)
- Systems using the KXSD9 sensor with runtime PM enabled
Discovery Timeline
- 2026-07-25 - CVE-2026-64503 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64503
Vulnerability Analysis
The vulnerability is a runtime PM reference-count imbalance [CWE-772: Missing Release of Resource] in the kxsd9_write_raw() function of the IIO accelerometer subsystem. The function calls pm_runtime_get_sync() at entry to ensure the device is powered up before servicing the write request. When the caller supplies a scale whose integer component is non-zero, the switch handler returns -EINVAL immediately without executing the paired pm_runtime_put_autosuspend().
Each failed write increments the runtime PM usage counter by one without a matching decrement. Once the counter is non-zero, the PM core cannot transition the device into the autosuspend state. The device remains powered on indefinitely, drawing current and preventing platform-level power savings.
Root Cause
The root cause is a control-flow error in error handling. The original code path returns directly from within the switch statement rather than assigning the error code to the return variable and falling through to the shared cleanup label that invokes pm_runtime_put_autosuspend(). The upstream fix sets the error code and allows execution to reach the existing put call, restoring reference-count symmetry.
Attack Vector
Exploitation requires local access to the sysfs attributes of the KXSD9 IIO device (typically under /sys/bus/iio/devices/iio:deviceN/). A user with write permission to the scale attribute can trigger the imbalance by writing any value whose integer part is non-zero. Repeated invocation guarantees the device never re-enters low-power state. The vulnerability does not permit code execution or privilege escalation; the impact is limited to power availability and battery lifetime.
The patch modifies kxsd9_write_raw() to set ret = -EINVAL and fall through to the common cleanup path rather than returning early. Refer to the kernel commit 191fcfeb for the exact source change.
Detection Methods for CVE-2026-64503
Indicators of Compromise
- KXSD9 IIO device that never transitions to suspended state in /sys/bus/iio/devices/iio:deviceN/power/runtime_status after inactivity
- Non-zero and monotonically increasing values in /sys/bus/iio/devices/iio:deviceN/power/runtime_usage
- Elevated platform power draw correlated with writes to the in_accel_scale sysfs attribute
Detection Strategies
- Audit kernel version and applied patches against the fixed commits listed in the kernel.org references
- Instrument runtime PM tracepoints (rpm_suspend, rpm_resume, rpm_usage) to identify drivers with growing usage counters
- Correlate userspace writes to IIO sysfs attributes with subsequent failures of the affected device to autosuspend
Monitoring Recommendations
- Track power/runtime_status and power/runtime_usage for all IIO devices on supported hardware
- Baseline expected autosuspend behavior for accelerometer drivers and alert on deviations
- Log write attempts to accelerometer scale attributes and validate that supplied values match documented supported ranges
How to Mitigate CVE-2026-64503
Immediate Actions Required
- Update to a Linux kernel release that includes the upstream fix or the corresponding stable backport
- Verify running kernel version against the fixed commits published on kernel.org for each stable branch
- Restrict write permissions on IIO sysfs attributes to trusted users only
Patch Information
The fix is available across multiple kernel stable branches. Relevant commits include 13a91e86, 191fcfeb, 223703d6, 36154171, 44a5fd87, 6293211d, a93fd69c, and eeece4a8. Rebuild and deploy the patched kernel across affected systems.
Workarounds
- Unload the kxsd9 and kxsd9_i2c/kxsd9_spi modules if the accelerometer is not required
- Apply restrictive udev rules or filesystem permissions on /sys/bus/iio/devices/iio:deviceN/in_accel_scale to block unprivileged writes
- Validate userspace applications only write supported scale values with a zero integer part
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
