CVE-2026-64499
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion. If i2c_smbus_write_byte() fails, the function returns the error directly and leaves the runtime PM usage counter elevated. The matching postdisable callback is not called when preenable fails, so the reference is leaked and the device may remain runtime-active indefinitely. Store the I2C transfer result in ret and drop the runtime PM reference on failure before returning the error.
Affected versions
Linux kernel versions
6.11
and later are affected. Fixed in
6.12.96,
6.18.39,
7.1.4,
7.2-rc3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-64499?
CVE-2026-64499 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.11 onward and has been patched in 6.12.96, 6.18.39, 7.1.4 and others. CVE-2026-64499 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64499?
Yes. CVE-2026-64499 has been patched. Fixed versions include 6.12.96, 6.18.39, 7.1.4 and others. If you are running Linux kernel 6.11 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64499 actively exploited?
No. CVE-2026-64499 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.