SB2026072765 - Improper resource shutdown or release in Linux kernel iio adc driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-64499)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ads1119_triggered_buffer_preenable() in the ti-ads1119 ADC driver when starting a conversion after resuming the device. A local user can trigger an I2C transfer failure to cause a denial of service.

The issue can leave the runtime PM usage counter elevated, causing the device to remain runtime-active indefinitely when the preenable callback fails.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6537f08100189d12bec4975000244e6ac4873c28
• https://git.kernel.org/stable/c/adf4bc07f814da8329278d32600147f5a150938c
• https://git.kernel.org/stable/c/f40292fb19399a3c3f82de698023ba87c01e66cf
• https://git.kernel.org/stable/c/ffb2195921c3d629194b9807de589578df9f9cb8