CVE-2026-64494iio: light: gp2ap002: fix runtime PM leak on read error
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runtime_put_autosuspend() call at the "out" label, permanently leaking a runtime PM reference and preventing the device from autosuspending. Replace the direct return with a "goto out" to ensure the reference is properly dropped on the error path.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 23 days later
· 23 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Awaiting Analysis.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < 62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < 7110201c6b21455240c63388f30113f3baafacfc
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < 2593f0c6ea37df168975694a3b17e7086f11453e
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < f350883989ced96d6da7f582f9a6f9c6ffc94e34
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < 29137052c4485c74bc2d1b0717f69ca4de14274f
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < 0c655d067ac69ee24e2e9d706c54179ea58a43db
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < 2ebaea7f3089decb01a8294d89d7e0cf288146c4
- affected f6dbf83c17cb223ceabd7c42d441414f3e0e8a86 – < 38b72267b7e22768a1f26d9935de4e1752a1dc85
- affected f3e84bf3f86bb3b7bd50666bb8ef7a203a656ca3
- affected 5.7.6 – < 5.8
- affected 5.8
- unaffected < 5.8
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.96 – ≤ 6.12.*
- unaffected 6.18.39 – ≤ 6.18.*
- unaffected 7.1.4 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5 (opens in a new tab)
- https://git.kernel.org/stable/c/7110201c6b21455240c63388f30113f3baafacfc (opens in a new tab)
- https://git.kernel.org/stable/c/2593f0c6ea37df168975694a3b17e7086f11453e (opens in a new tab)
- https://git.kernel.org/stable/c/f350883989ced96d6da7f582f9a6f9c6ffc94e34 (opens in a new tab)
- https://git.kernel.org/stable/c/29137052c4485c74bc2d1b0717f69ca4de14274f (opens in a new tab)
- https://git.kernel.org/stable/c/0c655d067ac69ee24e2e9d706c54179ea58a43db (opens in a new tab)
- https://git.kernel.org/stable/c/2ebaea7f3089decb01a8294d89d7e0cf288146c4 (opens in a new tab)
- https://git.kernel.org/stable/c/38b72267b7e22768a1f26d9935de4e1752a1dc85 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-48838 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64494)Record last updated .