Executive brief
The Linux kernel's APDS9306 light sensor driver contains a resource management bug where the apds9306_read_data() function fails to release power management references on certain error paths. This prevents the device from entering low-power suspend states and can gradually degrade system power efficiency, particularly on battery-powered devices that rely on runtime power management.
Technical details
The vulnerability is a resource leak in the IIO light sensor driver (drivers/iio/light/apds9306.c). The function apds9306_read_data() calls pm_runtime_resume_and_get() to acquire a runtime PM reference, but several error return paths exit the function directly without calling the corresponding pm_runtime_put_autosuspend() to release the reference. This causes the reference count to remain elevated, preventing the device from autosuspending. The fix uses PM_RUNTIME_ACQUIRE_AUTOSUSPEND() and PM_RUNTIME_ACQUIRE_ERR() macros to ensure proper cleanup on all return paths. No active exploitation in the wild has been reported; this is a resource management defect discovered through code analysis.
Affected products
- Linux Linux kernel all versions with APDS9306 support (from 620d1e6c7a3f onwards)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-08-07: patched: Fix committed upstream by Jonathan Cameron
- 2026-09-11: patched: Fix included in stable kernels