CVE-2026-64499 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
A reference leak in the TI ADS1119 ADC driver can cause the device to remain runtime-active indefinitely, leading to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64499?
CVE-2026-64499 is a denial of service vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion.
If i2c_smbus_write_byte() fails, the function returns the error directly and leaves the runtime PM usage counter elevated. The matching postdisable callback is not called when preenable fails, so the reference is leaked and the device may remain runtime-active indefinitely.
Store the I2C transfer result in ret and drop the runtime PM reference on failure before returning the error.
Which versions are affected by CVE-2026-64499?
How do I fix CVE-2026-64499?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64499 being exploited?
There is no known exploitation of CVE-2026-64499 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-64499, DEBIAN-CVE-2026-64499, GHSA-jrf5-24f4-rfq7, ROOT-OS-UBUNTU-2204-CVE-2026-64499, UBUNTU-CVE-2026-64499.