Executive brief
A vulnerability was identified in the Linux kernel's driver for the ROHM BH1780 light sensor. An error in how the system manages power for this sensor could lead to a resource leak, potentially causing system instability or preventing the hardware from entering power-saving modes correctly. This issue primarily affects systems using this specific light sensor hardware.
Technical details
A resource leak (CWE-401) exists in drivers/iio/light/bh1780.c within the bh1780_read_raw function. The driver calls pm_runtime_get_sync() to increment the power management reference count but fails to call pm_runtime_put_autosuspend() if the subsequent bh1780_read_word operation returns an error. This results in a permanent increment of the reference count, preventing the device from ever entering a low-power state. An attacker with local access could potentially trigger this error path repeatedly to exhaust resources or impact system power management. The fix involves reordering the code to ensure the reference count is decremented regardless of the read operation's success.
Affected products
- Linux Linux Kernel 4.7 to 5.10.253, 6.1.167, 6.6.130, 6.18.19, 6.19.9
Timeline
- 2026-05-08: advisory: NVD publication date
- 2026-03-19: patched: Initial patch authored
References
- https://git.kernel.org/stable/c/1eb3af4f59e09323788860a9155e9766b12891e5
- https://git.kernel.org/stable/c/33661bfc85c14836bfef4425a74b0ca2df4bb5ad
- https://git.kernel.org/stable/c/4228f7f053b452be625919ccbb605912bae0dc98
- https://git.kernel.org/stable/c/424bf90e87134effe4bd932608a15286493b11ab
- https://git.kernel.org/stable/c/aae572ddc28578af476cce7da3faec0395ef0bf0
- https://git.kernel.org/stable/c/ad58fa1cb11e4ceb702786a494352c7ff2eca1ed
- https://git.kernel.org/stable/c/dd72e6c3cdea05cad24e99710939086f7a113fb5