CVE-2026-43357
Linux Kernel pm_runtime Error Handling in MPU3050 Gyro Driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's iio gyro driver for the mpu3050-core. The issue is that the function pm_runtime_get_sync() is called without checking its return value, which means the driver might try to access hardware that failed to resume properly. Additionally, the device usage count is incremented unconditionally, even if resuming the device fails. The fix involves using pm_runtime_resume_and_get(), which correctly propagates errors and prevents incrementing the usage count if the resume operation fails. Also, in the preenable phase, pm_runtime_put_autosuspend() is added on failure of set_8khz_samplerate() to handle cases where postdisable does not run.
How can this vulnerability impact me? :
If the driver accesses hardware that failed to resume due to unchecked return values, it could lead to undefined behavior, potential system instability, or hardware malfunction. Incrementing the device usage count incorrectly might prevent proper power management, causing increased power consumption or resource leaks.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by updating the Linux kernel to a version where the iio: gyro: mpu3050-core driver uses pm_runtime_resume_and_get() instead of pm_runtime_get_sync(), which properly handles errors and avoids incrementing the device usage count on failure.
Therefore, the immediate mitigation step is to apply the kernel update that includes this fix.