CVE-2026-98679 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel configurations, especially those involving the kxcjk-1013 accelerometer driver, should assess exposure and prioritize verification of patch application. System administrators and security teams should be aware of potential compensating controls, such as monitoring for 'Runtime PM usage count underflow' warnings.

Why it matters

CVE-2026-98679 is a vulnerability in the Linux kernel's iio: accel: kxcjk-1013 component that can cause a runtime PM usage count underflow. Defenders should assess exposure, prioritize verification of patch application, and consider compensating controls like monitoring for 'Runtime PM usage count underflow' warnings.

• Verification of Linux kernel configurations for kxcjk-1013 driver usage is necessary to assess exposure.
• Patch application is required to prevent runtime PM usage count underflow.
• Monitoring for 'Runtime PM usage count underflow' warnings can help detect potential exploitation.
• Incident response plans should be reviewed and updated to address potential exploitation of this vulnerability.

Technical summary

The Linux kernel's iio: accel: kxcjk-1013 component is vulnerable to a runtime PM usage count underflow caused by duplicate event disable requests. The IIO core does not filter duplicate writes to the event enable attribute, and kxcjk1013_write_event_config() does not properly handle repeated disable requests, leading to a potential 'Runtime PM usage count underflow' warning. This issue arises because the IIO core does not filter duplicate writes to the event enable attribute, and the kxcjk1013_write_event_config() function does not handle repeated disable requests properly. Specifically, a repeated disable request calls kxcjk1013_set_power_state(data, false), dropping a runtime PM reference that was not for  

Defensive priority

Defenders should assess exposure and prioritize verification of Linux kernel configurations, especially those involving the kxcjk-1013 accelerometer driver. They should verify if their systems are using the affected driver and if the patch has been applied. Compensating controls, such as monitoring for 'Runtime PM usage count underflow' warnings, may be necessary until remediation is confirmed.

Recommended defensive actions

• Verify Linux kernel configurations for kxcjk-1013 driver usage
• Check for and apply patches to address the vulnerability
• Monitor system logs for 'Runtime PM usage count underflow' warnings
• Review and update incident response plans for potential exploitation
• Perform asset inventory to identify potentially affected systems
• Implement compensating controls for exposed systems
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Linux kernel patch notes and Git commit history offer technical insights into the fix. However, there is limited information on actual exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.