CVE-2026-90249

CVE-2026-90249

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
11.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

The IIO core does not filter duplicate writes to the event enable

attribute, so writing the same value twice invokes

write_event_config() twice. Enabling twice leaks a runtime PM

reference, preventing the device from ever suspending again;

disabling twice underflows the usage count and triggers a

"Runtime PM usage count underflow" warning.

Bail out early when the requested state matches the current state.

While at it, switch to pm_runtime_resume_and_get() so a failed

resume is propagated to userspace instead of silently marking the

event enabled.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.8th percentile
Published
2026-09-17T21:17Z
References (8)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:07Z
    iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
    cvelistv5