CVE-2026-98679 iio: accel: kxcjk-1013: reject duplicate event disable
A local attacker can trigger a runtime PM usage count underflow in the kxcjk-1013 accelerometer driver, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98679?
CVE-2026-98679 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: kxcjk-1013: reject duplicate event disable
The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013_write_event_config() already ignores repeated enable requests, but a repeated disable request still calls kxcjk1013_set_power_state(data, false), dropping a runtime PM reference that was not acquired for this request. This can underflow the runtime PM usage count and trigger a "Runtime PM usage count underflow" warning.
Return early when the requested state already matches ev_enable_state.
Which versions are affected by CVE-2026-98679?
How do I fix CVE-2026-98679?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98679 being exploited?
There is no known exploitation of CVE-2026-98679 in the wild and no public exploit code.
Sources
Also known as AZL-109061, BELL-CVE-2026-98679, DEBIAN-CVE-2026-98679, GHSA-jg4r-9rqj-mgw5, UBUNTU-CVE-2026-98679.