Improper resource shutdown or release in Linux kernel - CVE-2026-64494
Published: July 27, 2026
Vulnerability identifier: #VU139438
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64494
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in gp2ap002_read_raw() when handling read errors from gp2ap002_get_lux(). A local user can trigger a read operation that causes an error to prevent the device from autosuspending and cause a denial of service.
The issue permanently leaks a runtime PM reference on the error path.
Affected software
Linux kernel
How to mitigate CVE-2026-64494
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0c655d067ac69ee24e2e9d706c54179ea58a43db
- https://git.kernel.org/stable/c/2593f0c6ea37df168975694a3b17e7086f11453e
- https://git.kernel.org/stable/c/29137052c4485c74bc2d1b0717f69ca4de14274f
- https://git.kernel.org/stable/c/2ebaea7f3089decb01a8294d89d7e0cf288146c4
- https://git.kernel.org/stable/c/38b72267b7e22768a1f26d9935de4e1752a1dc85
- https://git.kernel.org/stable/c/62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5
- https://git.kernel.org/stable/c/7110201c6b21455240c63388f30113f3baafacfc
- https://git.kernel.org/stable/c/f350883989ced96d6da7f582f9a6f9c6ffc94e34