CVE-2026-46239: media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl Three control cases (AUTOGAIN, EXPOSURE_AUTO, ANALOGUE_GAIN) directly return without calling pm_runtime_put(), causing runtime PM reference count leaks. Change these cases from 'return' to 'ret = ... break' pattern to ensure pm_runtime_put() is always called before function exit.

Affected products

Linux kernel: from 7.0 before 7.0.9 — fixed in 7.0.9

How to fix

Upgrade to a fixed version: Linux kernel 7.0.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-46239 or the next vulnerability affects your stack