Cloudanix VulnDB

CVE-2026-98679

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small bug in a Linux sensor driver can cause repeated warning messages when someone turns off the same setting more than once, which might annoy administrators but is unlikely to be used by attackers.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Duplicate writes to the event disable sysfs attribute in the kxcjk-1013 IIO driver invoke kxcjk1013_set_power_state(false) without a matching prior enable, underflowing the runtime PM usage counter and emitting a kernel warning.

Why it matters to the business

Systems using the affected accelerometer may experience repeated kernel log warnings and potential runtime power management instability after local configuration changes, increasing operational noise and minor risk of driver misbehavior on embedded or laptop platforms.

How an attack unfolds

An attacker with local access writes the event enable attribute to the disabled state multiple times via sysfs; the driver lacks duplicate-request filtering on the disable path, each time decrementing the runtime PM count until underflow occurs and the warning is triggered.

How to fix it

Apply the upstream fix that adds an early return when the requested event state already matches the current ev_enable_state; rebuild and deploy the patched kernel. Where live patching is available, target the kxcjk1013_write_event_config function.

How to confirm the fix worked

After patching, confirm the driver source contains the duplicate-state check before the power-state call; re-test by issuing repeated disable writes and verify absence of the underflow warning.

Typical attack path

  1. Obtain local shell or user context on a system exposing the kxcjk-1013 IIO device
  2. Locate the event enable sysfs attribute for the accelerometer
  3. Write the disabled state repeatedly in quick succession
  4. Observe runtime PM underflow warning in kernel logs

How to detect it

Search kernel logs (dmesg, journalctl) and /var/log/messages for 'Runtime PM usage count underflow' paired with kxcjk-1013 or iio_accel activity; inspect sysfs writes to event enable attributes for the device.

  • Runtime PM usage count underflow
  • kxcjk1013_write_event_config
  • kxcjk-1013.*event.*disable

What your security team should do

  • Prioritize patching on any Linux systems exposing the kxcjk-1013 accelerometer within the next 30 days
  • Add kernel log monitoring for 'Runtime PM usage count underflow' strings on affected hardware fleets
  • Review IIO sysfs exposure and restrict write access to trusted users only

The record

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013_write_event_config() already ignores repeated enable requests, but a repeated disable request still calls kxcjk1013_set_power_state(data, false), dropping a runtime PM reference that was not acquired for this request. This can underflow the runtime PM usage count and trigger a "Runtime PM usage count underflow" warning. Return early when the requested state already matches ev_enable_state.

Affected packages

Ecosystem Package Introduced Fixed