CVE-2026-64493 Linux CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those using the mpl115 driver, should assess exposure and apply patches or updates to prevent potential runtime PM leaks.

Why it matters

CVE-2026-64493 is a vulnerability in the Linux kernel's iio: pressure: mpl115 driver that can cause runtime PM leaks on read errors. Defenders should verify and apply patches, review system configurations, and assess exposure in Linux kernel-based systems using the mpl115 driver.

• Verification of Linux kernel versions and patch application is required to prevent potential device autosuspend issues.
• System administrators must review and update configurations for mpl115 driver usage to ensure proper runtime PM handling.

Technical summary

The Linux kernel's iio: pressure: mpl115 driver has a vulnerability that causes a runtime PM leak on read error. This occurs because mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync() before reading the processed pressure or raw temperature, but on the read error path, it returns without calling pm_runtime_put_autosuspend(). As a result, each failed read leaks a runtime PM reference, preventing the device from autosuspending. The fix involves dropping the runtime PM reference before checking the return value, ensuring both success and error paths are balanced.

Defensive priority

Verify and apply patches for Linux kernel versions affected by CVE-2026-64493, particularly in environments using the mpl115 driver.

Recommended defensive actions

• Verify Linux kernel versions in use and check for patches or updates addressing CVE-2026-64493.
• Review system configurations and deployment contexts using the mpl115 driver to assess exposure.
• Apply patches or updates provided by the Linux kernel maintainers to resolve the vulnerability.
• Track exceptions and retest remediated assets.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected components. However, specific version information and exploitation details are not provided. Defenders should verify Linux kernel versions in use, review system configurations and deployment contexts using the mpl115 driver to assess exposure, and apply patches or updates provided by the Linux kernel maintainers to resolve the vulnerability. The Linux kernel patch notes and source references provide additional context for the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.