CVE-2026-89936: Linux Kernel IIO DAC Privilege Escalation

CVE-2026-89936 Overview

CVE-2026-89936 is a resource management flaw in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the m62332 Digital-to-Analog Converter (DAC) driver. The m62332_set_value() function enables the Vcc regulator on every write of a non-zero value and disables it only on writes of zero, without tracking the channel's current state. Because kernel regulators use reference counting, transitioning a channel directly from one non-zero value to another increments the reference count more than once. A subsequent write of zero decrements the count only once, leaving the regulator enabled indefinitely.

Critical Impact
The regulator reference count never returns to zero, causing the Vcc supply to remain powered even when userspace requests it be disabled, wasting power and preventing correct hardware state transitions.

Affected Products

Linux kernel builds including the iio-dac-m62332 driver
Systems using the Mitsumi M62332 I2C DAC via the IIO subsystem
Downstream distributions shipping affected stable kernel branches

Discovery Timeline

2026-09-16 - CVE-2026-89936 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89936

Vulnerability Analysis

The m62332 driver exposes DAC channels through the Linux IIO framework. Each channel write invokes m62332_set_value(), which conditionally toggles the shared Vcc regulator. The original logic keyed the enable and disable calls solely on whether the newly written value was non-zero or zero, without comparing against the previously stored channel value.

Because Linux regulator APIs such as regulator_enable() and regulator_disable() are reference-counted, repeated enables must be matched by an equal number of disables. Writing successive non-zero values to the same channel calls regulator_enable() multiple times but never issues a compensating regulator_disable(). When userspace later writes zero, the driver decrements the reference only once, and the regulator remains active.

This manifests as a persistent power-on condition for the DAC supply rail, incorrect analog output states, and possible downstream effects on hardware depending on the regulator. The patch corrects the driver to toggle the regulator only on zero-to-non-zero and non-zero-to-zero transitions, using the previously stored channel value to detect the edge.

Root Cause

The root cause is missing state tracking around a reference-counted resource. The driver treated each I/O write as an independent enable or disable event rather than as a transition between channel states, violating the balanced enable/disable contract required by the regulator framework.

Attack Vector

Exploitation requires local access sufficient to issue writes to the DAC channel sysfs interface, typically root or a user in a privileged group. The vulnerability is not a memory corruption primitive; the impact is limited to resource mismanagement, incorrect hardware state, and denial of proper power sequencing. There is no evidence in the CVE record of remote exploitability or in-the-wild abuse.

The fix additionally balances the regulator on the I2C error path, ensuring the reference count remains consistent even when the underlying I2C transaction fails. See the upstream commits linked in the references for the exact code change.

Detection Methods for CVE-2026-89936

Indicators of Compromise

Regulator supplying the M62332 DAC reported as enabled in /sys/class/regulator/*/state after all channels have been written to zero
Unexpected non-zero use counts in /sys/kernel/debug/regulator/regulator_summary for the Vcc supply
Persistent DAC output voltage after software attempts to disable the channel

Detection Strategies

Inventory running kernel versions across Linux fleets and cross-reference against the fixed commits listed in the kernel.org references
Audit dmesg and kernel logs for repeated regulator_enable activity tied to the m62332 driver without matching disables
Verify whether the CONFIG_M62332 driver is compiled into the running kernel using zcat /proc/config.gz or the corresponding /boot/config-$(uname -r) file

Monitoring Recommendations

Track regulator reference counts on embedded and industrial systems that load the m62332 driver, alerting on counts that never return to zero
Monitor kernel package versions through configuration management to confirm patched builds are deployed
Include IIO driver changes in change-management review for systems that rely on precise analog output behavior

How to Mitigate CVE-2026-89936

Immediate Actions Required

Apply the vendor-supplied kernel update containing the patched m62332_set_value() implementation as soon as it is available for your distribution
On systems where patching is delayed, avoid writing successive non-zero values to the same DAC channel and instead write zero between value changes to keep the regulator reference count balanced
Restrict write access to IIO sysfs nodes to trusted service accounts only

Patch Information

The fix has been merged into multiple stable kernel branches. Refer to the upstream commits for the exact change: Kernel Git Commit 08ac8d2, Kernel Git Commit 1d3a7d7, Kernel Git Commit 9263b9a, Kernel Git Commit 9fe22f5, Kernel Git Commit a130404, Kernel Git Commit ae18d2d, Kernel Git Commit bac0ed8, and Kernel Git Commit f5acb82. Rebuild and redeploy affected kernels through your distribution's standard update process.

Workarounds

Unload or blacklist the m62332 module on systems where the DAC is not required until a patched kernel is deployed
When the driver must remain loaded, write zero to the channel before writing a new non-zero value so that each regulator enable is followed by a matching disable
Limit userspace access to IIO device nodes through udev rules or filesystem permissions to reduce the attack surface

bash

# Example: blacklist the m62332 driver until a patched kernel is installed
echo 'blacklist m62332' | sudo tee /etc/modprobe.d/blacklist-m62332.conf
sudo rmmod m62332 2>/dev/null || true