CVE-2026-64503
Received Received - Intake

Runtime PM Leak in Linux Kernel kxsd9 Accelerometer Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the matching pm_runtime_put_autosuspend(). This leaks a runtime PM usage-counter reference on every such write, after which the device can no longer autosuspend. Set the error code and fall through to the existing put instead of returning early.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64503
EUVD
EUVD-2026-48847

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a runtime power management (PM) imbalance in the kxsd9 accelerometer driver. When writing raw data with a specific scale value, the function kxsd9_write_raw() takes a PM reference but fails to release it properly on error, causing a leak. This prevents the device from entering autosuspend mode, draining power unnecessarily.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO accelerometer driver (kxsd9). Detection requires checking kernel logs for runtime PM imbalance warnings or errors related to kxsd9_write_raw(). Use dmesg | grep kxsd9 to search for relevant messages. If the device is actively used, monitor runtime PM status with cat /sys/bus/iio/devices/iio:deviceX/device/pm_runtime_status where X is the device number.

Impact Analysis

The impact is primarily on systems using the kxsd9 accelerometer. The leaked PM reference can lead to increased power consumption, reducing battery life in portable devices. It may also cause unexpected behavior or instability in systems relying on proper power management.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a runtime PM imbalance issue in the Linux kernel's IIO accelerometer driver that could lead to resource exhaustion but does not involve data privacy or security controls.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If immediate patching is not possible, avoid writing scale values with non-zero integer parts to the kxsd9 accelerometer device. Monitor runtime PM usage counters to detect leaks until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart