Executive brief
A vulnerability in the Linux kernel's MPL115 pressure sensor driver could allow a local attacker to prevent the device from entering low-power states. This occurs because the system fails to properly release power management references when a sensor read error happens. Over time, this can lead to increased power consumption and reduced battery life on affected hardware.
Technical details
A runtime power management (PM) reference leak exists in the mpl115_read_raw() function within drivers/iio/pressure/mpl115.c. The function calls pm_runtime_get_sync() to increment the usage counter before performing a read operation but fails to call pm_runtime_put_autosuspend() if the read operation returns an error. This imbalance prevents the device from ever reaching a zero-reference count required for autosuspension. The issue has been resolved by ensuring the reference is dropped regardless of the read operation's success or failure. Patches are available in various stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 7.1.y.
Affected products
- Linux Linux 6.2 to 6.6.145, 6.12.97, 6.18.39, 7.1.4
Timeline
- 2026-07-25: advisory: CVE-2026-64493 published by kernel.org
- 2026-07-25: patched
References
- https://git.kernel.org/stable/c/46e69d3dd429b33e50e2731913239f6af4ea2705
- https://git.kernel.org/stable/c/5022f4ed5aae974ec530e3cbf0bd223be13055f7
- https://git.kernel.org/stable/c/aab0fed636b14a5fd52fcae58b484f1cb96b841d
- https://git.kernel.org/stable/c/b3f1af4ba8e9cf33aa08c4cdcaa5a17b140521ec
- https://git.kernel.org/stable/c/fbe67ff37a6fd855a6c097f84f3738bd13d0a898