CVE-2026-90249

What it actually does

Duplicate writes to the event enable sysfs attribute in the gp2ap002 IIO driver invoke write_event_config() multiple times without state checks, causing repeated pm_runtime_get() calls that leak references (preventing suspend) or underflow the usage count on disable with associated warnings.

Why it matters to the business

Embedded Linux devices using this sensor may experience elevated power draw from inability to suspend, reduced battery life, or system warnings that complicate operations and maintenance in power-sensitive environments.

How an attack unfolds

An attacker with local access to the device's sysfs interface repeatedly writes identical values to the event enable attribute; because the IIO core passes duplicates through, each write triggers an unbalanced runtime PM operation that either leaks references or underflows the counter.

How to fix it

Update the Linux kernel to a version containing the fix that adds an early return when the requested state matches the current state and switches to pm_runtime_resume_and_get(); rebuild and deploy the updated kernel image to affected devices.

How to confirm the fix worked

After patching, confirm the new kernel source contains the state-check bailout in gp2ap002 write_event_config() and that pm_runtime_resume_and_get() is used; re-test by writing duplicate event values and verify no reference leaks or underflow warnings occur.

Typical attack path

1. Obtain local shell or process access on the affected Linux system
2. Locate the gp2ap002 event enable sysfs attribute under /sys/bus/iio/
3. Write the same enable/disable value multiple times in succession
4. Observe either blocked device suspend or runtime PM underflow warnings in dmesg

How to detect it

Search kernel logs (dmesg, journalctl) for repeated runtime PM reference or underflow warnings associated with the gp2ap002 or IIO light subsystem; inspect sysfs write patterns to the event enable attribute if audit logging is enabled.

• Runtime PM usage count underflow
• gp2ap002
• write_event_config

What your security team should do

• Prioritize kernel updates on any systems exposing the gp2ap002 driver in production or field deployments
• Monitor kernel logs for "Runtime PM usage count underflow" messages on devices using this sensor
• Restrict unprivileged write access to IIO sysfs attributes via filesystem permissions or SELinux policies where feasible