Executive brief
The m62332 Digital-to-Analog Converter (DAC) driver in the Linux kernel contains a bug in how it manages the Vcc power regulator. Every time a channel value is written, the driver incorrectly enables or disables the regulator without tracking state changes, causing the regulator to stay permanently enabled even when it should be off. This can lead to excessive power consumption and potential hardware damage on devices using this DAC.
Technical details
This is a reference counting bug in the m62332_set_value() function of drivers/iio/dac/m62332.c. The vulnerable code enables the Vcc regulator on every non-zero write and disables it on every zero write without tracking the channel's current state. Since the regulator uses reference counting, changing from one non-zero value to another causes multiple enable calls with only one disable, leaving the reference count permanently elevated and the regulator stuck on. The fix detects state transitions (zero-to-non-zero for enable, non-zero-to-zero for disable) using the previously stored channel value, and adds error handling to balance the reference count if an I2C write fails. This is a local code-level bug with no remote attack vector.
Affected products
- Linux Linux kernel affected versions prior to fix commit a130404ce0b69ca1438126bd81c1985d3b4d2e6f
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-07-03: patched: Fix commit a130404ce0b69ca1438126bd81c1985d3b4d2e6f authored