Improper resource shutdown or release in Linux kernel - CVE-2026-64503
Published: July 27, 2026
Vulnerability identifier: #VU139429
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64503
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in kxsd9_write_raw() when handling write requests for scale values with a non-zero integer part. A local user can send a crafted write request to cause a denial of service.
The issue leaks a runtime PM usage-counter reference, which can prevent the device from autosuspending.
Affected software
Linux kernel
How to mitigate CVE-2026-64503
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/13a91e8631cfeb68e5b7fd6687f194f5a86e83fe
- https://git.kernel.org/stable/c/191fcfeb729ededd8dd2a999c6bf351ddfa0cec7
- https://git.kernel.org/stable/c/223703d6e8bed50b6a0b47e160877909518d94b9
- https://git.kernel.org/stable/c/36154171385a8a2444a4b3c6eaa0c5294cb02478
- https://git.kernel.org/stable/c/44a5fd874bb6873bdaec59f722c1d57832fbc9df
- https://git.kernel.org/stable/c/6293211d142605bec435229ef0aa3668b8964164
- https://git.kernel.org/stable/c/a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20
- https://git.kernel.org/stable/c/eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc