Executive brief
A vulnerability was identified in the Linux kernel's driver for the Sharp GP2AP002 light sensor. When the system fails to read data from the sensor, it fails to release a power management lock, which prevents the device from entering a low-power sleep state. This can lead to increased power consumption and battery drain on affected hardware, though it does not directly expose user data.
Technical details
A runtime Power Management (PM) reference leak exists in the gp2ap002_read_raw() function within drivers/iio/light/gp2ap002.c. The function calls pm_runtime_get_sync() to wake the device, but if a subsequent call to gp2ap002_get_lux() fails, the function returns an error code immediately without calling pm_runtime_put_autosuspend(). This results in a permanent increment of the PM usage counter, preventing the device from ever autosuspending. An attacker with local access could potentially trigger this error repeatedly to cause a denial of service regarding power management (battery exhaustion). The issue has been resolved by replacing the direct return with a jump to the proper cleanup label.
Affected products
- Linux Core Team Linux Kernel 5.8 to 6.10.x
Timeline
- 2026-06-14: patched: Initial patch authored by Biren Pandya
- 2026-07-25: disclosed: CVE-2026-64494 published via NVD
References
- https://git.kernel.org/stable/c/0c655d067ac69ee24e2e9d706c54179ea58a43db
- https://git.kernel.org/stable/c/2593f0c6ea37df168975694a3b17e7086f11453e
- https://git.kernel.org/stable/c/29137052c4485c74bc2d1b0717f69ca4de14274f
- https://git.kernel.org/stable/c/2ebaea7f3089decb01a8294d89d7e0cf288146c4
- https://git.kernel.org/stable/c/38b72267b7e22768a1f26d9935de4e1752a1dc85
- https://git.kernel.org/stable/c/62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5
- https://git.kernel.org/stable/c/7110201c6b21455240c63388f30113f3baafacfc