CVE-2026-89889: Linux Kernel imx415 Runtime PM Vulnerability

CVE-2026-89889 Overview

CVE-2026-89889 identifies a resource management flaw in the Linux kernel's imx415 image sensor driver (media: i2c: imx415). The VBLANK code path acquired a runtime power management reference through pm_runtime_get_if_in_use() but returned early when programming the VMAX register failed. The early return skipped the matching pm_runtime_put() call, leaving the runtime PM reference count elevated.

Critical Impact
Repeated VBLANK write failures leak runtime PM references on the imx415 sensor, preventing the device from entering low-power states and causing the driver to remain in an inconsistent power management state.

Affected Products

Linux kernel builds including the imx415 I2C camera sensor driver (drivers/media/i2c/imx415.c)
Distributions shipping stable kernels prior to the fixes referenced in commits 1aa66bb3ba44, 46c63cc1c1ae, and bea3001e0f32
Embedded and multimedia platforms using the Sony IMX415 CMOS sensor over I2C

Discovery Timeline

2026-09-16 - CVE-2026-89889 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89889

Vulnerability Analysis

The defect resides in the VBLANK control handler of the imx415 sensor driver. The handler calls pm_runtime_get_if_in_use() to safely obtain a runtime PM reference before writing the VMAX register that governs vertical blanking. When the register programming failed, the code returned immediately from the switch case instead of falling through to the common cleanup path that invokes pm_runtime_put().

Each failing VBLANK adjustment therefore increments the runtime PM usage counter without a matching decrement. Over time, the counter stays elevated and the device cannot autosuspend. This is a resource management defect: the reference is a bounded kernel resource, and the missing release keeps the sensor device active longer than intended.

The severity is limited because triggering the leak requires the VMAX register write to fail, which typically depends on transient I2C bus errors or unexpected device states. However, sustained failures can render the sensor unresponsive to power state transitions until the driver is unloaded.

Root Cause

The root cause is asymmetric handling of the runtime PM reference in the VBLANK control path. pm_runtime_get_if_in_use() succeeded and incremented the reference, but the error branch used return rather than break, bypassing the shared pm_runtime_put() invocation that follows the switch statement.

Attack Vector

The issue is not remotely exploitable and requires local conditions that induce VMAX write failures on the I2C bus. There is no evidence of exploitation. The practical impact is degraded power management and potential denial of low-power operation on affected embedded devices.

No verified exploit code is available. See the upstream commit references for the source-level fix details: Linux Kernel Commit 1aa66bb, Linux Kernel Commit 46c63cc, and Linux Kernel Commit bea3001e.

Detection Methods for CVE-2026-89889

Indicators of Compromise

Elevated runtime_usage values under /sys/devices/.../power/ for the imx415 I2C sensor that never return to zero during idle periods.
Kernel log entries reporting failed VMAX register writes from the imx415 driver correlated with sustained device wakefulness.
Repeated inability of the sensor node to enter suspended runtime PM status despite no active media pipeline.

Detection Strategies

Audit kernel and vendor BSP versions to confirm whether the imx415 driver includes the commits 1aa66bb3ba44, 46c63cc1c1ae, or bea3001e0f32.
Instrument runtime PM state transitions on media devices and alert when reference counts remain non-zero without an active streaming session.
Correlate I2C error counters with power management state to identify hosts where failed sensor writes coincide with stuck PM references.

Monitoring Recommendations

Collect dmesg and journald output containing imx415 diagnostic messages into centralized logging for trend analysis.
Monitor thermal and power telemetry on embedded platforms hosting the IMX415 sensor to detect abnormal idle power draw.
Track kernel package versions across fleets to ensure patched builds propagate to all camera-enabled devices.

How to Mitigate CVE-2026-89889

Immediate Actions Required

Upgrade affected systems to a Linux kernel that incorporates the upstream fix for the imx415 VBLANK runtime PM path.
Rebuild vendor and downstream kernels that carry the imx415 driver to include the referenced stable commits.
Restart devices exhibiting stuck runtime PM references after applying the patch to reset the sensor state.

Patch Information

The fix replaces the early return in the VBLANK error branch with a break, ensuring control reaches the shared pm_runtime_put() call. The corrections are recorded in the stable tree under commits 1aa66bb3ba440aabb3bfe65ba5f19bef86a0f823, 46c63cc1c1aefa08d3126000d5b56dabb62e801f, and bea3001e0f32527a291444e527e84a7ea9b546d4. Apply the kernel update from your distribution or backport the commits into custom kernel builds.

Workarounds

Avoid runtime adjustment of the VBLANK control on the imx415 sensor when I2C bus reliability is degraded.
Reload the imx415 kernel module to reset the runtime PM reference count when a leak is observed, as a temporary measure until patching.
Where feasible, disable the imx415 driver on systems that do not require the sensor pending patch deployment.

bash

# Verify installed kernel and confirm imx415 driver status
uname -r
modinfo imx415 | grep -E 'filename|version|srcversion'

# Inspect runtime PM state for the sensor device (replace path as needed)
for f in /sys/bus/i2c/drivers/imx415/*/power/runtime_status; do
  echo "$f: $(cat $f)"
done

# Temporary reset: reload the module if a reference leak is suspected
sudo modprobe -r imx415 && sudo modprobe imx415