CVE-2026-98679 Overview
CVE-2026-98679 affects the Linux kernel's Industrial I/O (IIO) subsystem, specifically the kxcjk-1013 accelerometer driver. The vulnerability stems from unfiltered duplicate writes to the event enable attribute. When userspace issues a repeated disable request, the driver calls kxcjk1013_set_power_state(data, false) and drops a runtime Power Management (PM) reference that was never acquired for that request. The resulting runtime PM usage count underflow triggers a kernel warning and can destabilize power management state tracking for the device.
Critical Impact
Repeated event disable writes underflow the runtime PM usage count, generating kernel warnings and potentially leaving the accelerometer in an inconsistent power state.
Affected Products
- Linux kernel builds including the drivers/iio/accel/kxcjk-1013.c driver prior to the fix
- Systems using Kionix KXCJK-1013 and related accelerometers exposed through the IIO subsystem
- Downstream distributions that have not yet backported the stable tree patches
Discovery Timeline
- 2026-10-18 - CVE-2026-98679 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98679
Vulnerability Analysis
The kxcjk-1013 driver exposes event enable attributes through the IIO sysfs interface. The IIO core does not deduplicate writes to these attributes, so userspace can issue the same disable request multiple times. The function kxcjk1013_write_event_config() correctly short-circuits repeated enable requests but does not apply the same guard to disable requests.
On each repeated disable call, the driver invokes kxcjk1013_set_power_state(data, false), which releases a runtime PM reference. Because no matching reference was taken for the duplicate call, the kernel's runtime PM usage counter decrements below its expected value. The kernel detects this and emits a "Runtime PM usage count underflow" warning through WARN().
The fix adds an early return when the requested state already matches ev_enable_state, mirroring the existing deduplication logic for enable requests.
Root Cause
The root cause is missing idempotency on the disable path of kxcjk1013_write_event_config(). The function compares the requested state only when enabling events, allowing duplicate disable writes to reach the power state transition logic. This is a kernel driver logic flaw affecting state consistency rather than a memory safety issue.
Attack Vector
Triggering the condition requires local write access to the IIO sysfs event enable attribute for the device. An unprivileged process with permissions on /sys/bus/iio/devices/iio:deviceX/events/ can issue repeated disable writes to cause runtime PM counter underflow. The impact is limited to local denial of stability on the affected device and kernel log noise. No remote attack vector is applicable.
See the stable tree commits for the specific code paths and fix diffs: Kernel Patch 137c35c, Kernel Patch 3365209, Kernel Patch aa94a37, Kernel Patch ad690c0, and Kernel Patch dd30c10.
Detection Methods for CVE-2026-98679
Indicators of Compromise
- Kernel log entries containing the string Runtime PM usage count underflow associated with the kxcjk-1013 device
- WARN() backtraces in dmesg referencing pm_runtime_put or runtime PM accounting functions originating from the IIO accel driver
- Repeated writes of 0 to in_accel_*_thresh_either_en sysfs attributes from unexpected processes
Detection Strategies
- Parse /var/log/kern.log and journalctl -k output for runtime PM underflow warnings tied to IIO devices
- Enable kernel auditing on /sys/bus/iio/devices/ to track processes writing to event enable attributes
- Correlate kernel warning events with the running kernel version to identify unpatched hosts
Monitoring Recommendations
- Forward kernel ring buffer events into a centralized log pipeline for host-level anomaly review
- Alert on recurring WARN_ON conditions in the IIO or runtime PM subsystems across the fleet
- Track kernel package versions through configuration management to confirm the stable patches are deployed
How to Mitigate CVE-2026-98679
Immediate Actions Required
- Apply the stable kernel patches referenced above to any host running the kxcjk-1013 driver
- Audit filesystem permissions on /sys/bus/iio/devices/ and restrict write access to privileged processes only
- Inventory devices that load the kxcjk-1013 module using lsmod or modinfo to scope exposure
Patch Information
The fix is distributed across multiple stable kernel trees. Reference the upstream commits 137c35c, 3365209, aa94a37, ad690c0, and dd30c10. Install the vendor-provided kernel update that includes the corresponding backport for your distribution.
Workarounds
- Unload the kxcjk-1013 module on systems that do not require the accelerometer using modprobe -r kxcjk-1013
- Blacklist the driver through /etc/modprobe.d/ on servers or appliances where the sensor is not needed
- Restrict sysfs write permissions on affected IIO event enable attributes to prevent unprivileged userspace from issuing repeated disable writes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
