CVE-2026-90249iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes write_event_config() twice. Enabling twice leaks a runtime PM reference, preventing the device from ever suspending again; disabling twice underflows the usage count and triggers a "Runtime PM usage count underflow" warning. Bail out early when the requested state matches the current state. While at it, switch to pm_runtime_resume_and_get() so a failed resume is propagated to userspace instead of silently marking the event enabled.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 32 days later
· 32 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < b2d7a97d75b648a643f60d77f4d6d70161268855
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < 685d9d1e5c47e024413981fb7eddab86132b04a1
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < 56fe8e5f313a64e458bb6f8b982de925345e21a7
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < 8e76ab81319858736ccf23141e9415f9a1869337
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < 70b9482926ca92862460e659f5e5fde99ae0b4fa
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < 0fc740c25c9abb25113398ebb58e2f2ce57741a7
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < 470edb012b1d9a4fba1cd59e329e60f0798c791a
- affected 97d642e23037c5545266f9564c9b81e6db81b122 – < 579c049b4cb6fc72ce2c505fc5334540be0efcd3
- affected 5.7
- unaffected < 5.7
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/b2d7a97d75b648a643f60d77f4d6d70161268855 (opens in a new tab)
- https://git.kernel.org/stable/c/685d9d1e5c47e024413981fb7eddab86132b04a1 (opens in a new tab)
- https://git.kernel.org/stable/c/56fe8e5f313a64e458bb6f8b982de925345e21a7 (opens in a new tab)
- https://git.kernel.org/stable/c/8e76ab81319858736ccf23141e9415f9a1869337 (opens in a new tab)
- https://git.kernel.org/stable/c/70b9482926ca92862460e659f5e5fde99ae0b4fa (opens in a new tab)
- https://git.kernel.org/stable/c/0fc740c25c9abb25113398ebb58e2f2ce57741a7 (opens in a new tab)
- https://git.kernel.org/stable/c/470edb012b1d9a4fba1cd59e329e60f0798c791a (opens in a new tab)
- https://git.kernel.org/stable/c/579c049b4cb6fc72ce2c505fc5334540be0efcd3 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-81842 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90249)Record last updated .