CVE-2026-64494
Received Received - Intake

Runtime PM Leak in gp2ap002 Light Sensor Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runtime_put_autosuspend() call at the "out" label, permanently leaking a runtime PM reference and preventing the device from autosuspending. Replace the direct return with a "goto out" to ensure the reference is properly dropped on the error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64494
EUVD
EUVD-2026-48838

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the IIO light sensor driver gp2ap002. It involves a runtime power management (PM) reference leak during sensor read errors. When reading light values fails, the function skips releasing a PM reference, preventing the device from entering low-power mode.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO light sensor subsystem, particularly the gp2ap002 driver. Detection requires checking the kernel version and verifying if the affected driver is loaded. Use commands like 'uname -a' to check kernel version and 'lsmod | grep gp2ap002' to see if the driver is loaded.

Impact Analysis

This could cause increased power consumption on affected devices using the gp2ap002 light sensor. The device may fail to enter low-power states, draining battery life on mobile or embedded systems.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the vulnerability. If immediate patching is not possible, consider disabling the gp2ap002 driver by blacklisting it or removing the affected module with 'rmmod gp2ap002'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart