Executive brief
The Linux kernel's GP2AP002 light sensor driver for IIO (Industrial I/O) contains a resource management bug where duplicate writes to the event enable attribute leak runtime power management references. This causes the device to become unable to suspend, wasting battery power and potentially destabilizing system power management. The bug also causes warnings or system instability when disabling the same event twice.
Technical details
The vulnerability is a resource leak in the gp2ap002_write_event_config() function within drivers/iio/light/gp2ap002.c. The IIO core does not filter duplicate writes to event enable attributes, so writing the same value consecutively invokes the function twice without early exit logic. Enabling the event twice calls pm_runtime_get_sync() twice, leaking a reference and preventing the device from suspending; disabling twice causes pm_runtime_put_autosuspend() underflow and triggers runtime PM warnings. The fix adds an early return when the requested state matches the current state and switches from pm_runtime_get_sync() to pm_runtime_resume_and_get() to properly propagate resume failures. The vulnerability affects the GP2AP002x00F light sensor driver and is local to systems with this device; no network attack vector exists.
Affected products
- Linux Linux kernel affected versions prior to fix commit 579c049b4cb6fc72ce2c505fc5334540be0efcd3
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-07-22: patched: Upstream fix commit 579c049b4cb6fc72ce2c505fc5334540be0efcd3 authored by Nikhil Gautam