CVE-2026-89935 Overview
CVE-2026-89935 is a runtime power management (PM) reference leak in the Linux kernel's Industrial I/O (IIO) subsystem. The flaw affects the apds9306 ambient light sensor driver. The function apds9306_read_data() calls pm_runtime_resume_and_get() but several error paths return without calling pm_runtime_put_autosuspend(). This leaks the runtime PM reference and prevents the device from autosuspending. The upstream fix converts the driver to use PM_RUNTIME_ACQUIRE_AUTOSUSPEND() and PM_RUNTIME_ACQUIRE_ERR(), which release the reference on all return paths automatically.
Critical Impact
The runtime PM reference leak keeps the APDS9306 light sensor from entering low-power autosuspend, causing continued power draw and preventing correct device state management.
Affected Products
- Linux kernel builds including the iio/light/apds9306 driver prior to the fixing commits
- Distributions shipping the affected apds9306 IIO light sensor driver
- Embedded and mobile Linux systems using the APDS9306 ambient light sensor
Discovery Timeline
- 2026-09-16 - CVE-2026-89935 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89935
Vulnerability Analysis
The vulnerability resides in the apds9306_read_data() function within the Linux kernel IIO light sensor driver for the Avago APDS9306 device. The function acquires a runtime PM reference by calling pm_runtime_resume_and_get(), which increments the device's runtime usage counter and resumes it if suspended. Several error paths in the function return directly to the caller without invoking the paired pm_runtime_put_autosuspend() call. Each failed read therefore leaves the runtime usage counter elevated. Because the runtime PM core only permits autosuspend when the counter drops to zero, the device remains resumed indefinitely after any error. This is a resource leak class of defect that maps conceptually to Memory Leak semantics applied to a kernel-managed reference counter.
Root Cause
The root cause is unbalanced runtime PM reference handling. The successful path releases the reference, but early return statements on error omit the required pm_runtime_put_autosuspend() call. The fix replaces the manual acquire and release pattern with the scoped helpers PM_RUNTIME_ACQUIRE_AUTOSUSPEND() and PM_RUNTIME_ACQUIRE_ERR(), ensuring the reference is released on every exit path.
Attack Vector
This is a local reliability and power-management defect rather than a remotely reachable code execution flaw. Triggering the leak requires conditions that cause apds9306_read_data() to take an error path, such as I2C bus faults or invalid sensor state during a read from the IIO sysfs interface. Repeated failing reads accumulate leaked references, blocking autosuspend and increasing power consumption on affected devices.
No verified exploit code is available. See the upstream patches for the technical fix: Kernel Git Commit 3ce75e4, Kernel Git Commit d378fce, and Kernel Git Commit f3d9780.
Detection Methods for CVE-2026-89935
Indicators of Compromise
- Devices bound to the apds9306 driver remaining in an active runtime PM state indefinitely after IIO read errors.
- Elevated runtime_usage counters visible under /sys/bus/i2c/devices/<dev>/power/runtime_usage for APDS9306 sensors.
- Unexpected battery drain or thermal behavior on embedded systems using the APDS9306 sensor.
Detection Strategies
- Audit kernel package versions against distribution advisories referencing the fixing commits 3ce75e4, d378fce, and f3d9780.
- Inspect the apds9306 driver source in the running kernel tree to verify use of PM_RUNTIME_ACQUIRE_AUTOSUSPEND() and PM_RUNTIME_ACQUIRE_ERR().
- Monitor sysfs power/runtime_status for affected IIO devices to identify devices that never transition to suspended.
Monitoring Recommendations
- Track kernel build provenance across fleets to identify hosts running unpatched IIO subsystems.
- Correlate I2C bus error logs with sustained sensor power draw to surface leak-triggering conditions.
- Include kernel patch level in configuration management inventory for embedded and mobile Linux endpoints.
How to Mitigate CVE-2026-89935
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry to systems using the apds9306 driver.
- Prioritize battery-powered and embedded devices where the runtime PM leak has direct operational impact.
- Validate that vendor kernel branches for embedded platforms include the backported fix before production rollout.
Patch Information
The fix is available in the mainline and stable Linux kernel trees via the following commits: Kernel Git Commit 3ce75e4, Kernel Git Commit d378fce, and Kernel Git Commit f3d9780. Rebuild and redeploy affected kernel images, or install updated distribution kernel packages once available.
Workarounds
- Unload the apds9306 module on systems that do not require ambient light sensing to eliminate exposure to the leak path.
- Avoid workloads that repeatedly poll the affected IIO sysfs attributes under conditions that trigger sensor read errors.
- Where module removal is not feasible, schedule periodic reboots to reclaim leaked runtime PM references until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.