What’s Vulnerable › Vulnerabilities

CVE-2026-89935: iio: light: apds9306: fix PM reference leak in apds9306_read_data()

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: iio: light: apds9306: fix PM reference leak in apds9306_read_data() apds9306_read_data() calls pm_runtime_resume_and_get() but several error paths return directly without calling pm_runtime_put_autosuspend(), leaking the runtime PM reference and preventing the device from autosuspending. Use PM_RUNTIME_ACQUIRE_AUTOSUSPEND() and PM_RUNTIME_ACQUIRE_ERR() to automatically handle runtime PM reference release on all return paths.

Affected products

• Linux kernel: 6.10 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3ce75e455dd6eaa775fb0badb31c0b100c7a01fe
• https://git.kernel.org/stable/c/d378fceaafd79e0dc59d3546bda251a3058062c0
• https://git.kernel.org/stable/c/f3d97800b03cd39ec135e544dcd0a93ffd18e4c7

Get alerted when CVE-2026-89935 or the next vulnerability affects your stack