{"id":"CVE-2026-98679","kind":"vulnerability","aliases":["CVE-2026-98679"],"related":[],"title":"Linux kernel: duplicate IIO event disable underflows runtime PM count","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kxcjk-1013: reject duplicate event disable\n\nThe IIO core does not filter duplicate writes to the event enable\nattribute. kxcjk1013_write_event_config() already ignores repeated\nenable requests, but a repeated disable request still calls\nkxcjk1013_set_power_state(data, false), dropping a runtime PM reference\nthat was not acquired for this request. This can underflow the runtime\nPM usage count and trigger a \"Runtime PM usage count underflow\" warning.\n\nReturn early when the requested state already matches ev_enable_state.","summary":"In the Linux kernel's kxcjk-1013 accelerometer driver, repeatedly disabling an event drops a runtime PM reference that was never taken. This underflows the usage counter and logs a warning.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio","infrastructure","linux-kernel"],"not_affected_if":["no-kxcjk-1013-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit resolving this issue, per the kernel stable tree or your distribution's advisory.","status":"open","published_at":"2026-10-18T16:17:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:15+00:00","updated_at":"2026-10-25T05:19:15+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:19:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit resolving this issue, per the kernel stable tree or your distribution's advisory.","reach":"local","title":"Linux kernel: duplicate IIO event disable underflows runtime PM count","impact":"low","summary":"In the Linux kernel's kxcjk-1013 accelerometer driver, repeatedly disabling an event drops a runtime PM reference that was never taken. This underflows the usage counter and logs a warning.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","iio","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Runtime PM usage count underflow warning; no code execution described","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-kxcjk-1013-hardware"],"who_is_affected":"Systems running a Linux kernel with the kxcjk-1013 IIO accelerometer driver, typically hardware that uses this sensor. The sources do not describe the impact on systems without this hardware, so the rest can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000558,"input_tokens":3426,"output_tokens":430,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1013':29B,67C '-2026':12A,15A '-98679':13A,16A 'accel':65C 'acceleromet':30B 'acquir':115C 'alreadi':89C,142C 'attribut':84C 'call':100C 'config':88C 'core':74C 'count':10A,126C,133C 'counter':49B 'cve':11A,14A 'data':105C 'disabl':6A,33B,71C,97C 'driver':31B 'drop':36B,107C 'duplic':3A,69C,78C 'earli':137C 'embed':17B 'enabl':83C,92C,145C 'ev':144C 'event':5A,35B,70C,82C,87C 'fals':106C 'filter':77C 'follow':59C 'ignor':90C 'iio':4A,18B,64C,73C 'infrastructur':19B 'kernel':2A,22B,26B,57C 'kxcjk':28B,66C 'kxcjk1013':85C,101C 'linux':1A,21B,25B,56C 'linux-kernel':20B 'log':51B 'match':143C 'never':43B 'pm':9A,39B,110C,124C,131C 'power':103C 'refer':40B,111C 'reject':68C 'repeat':32B,91C,96C 'request':93C,98C,118C,140C 'resolv':63C 'return':136C 'runtim':8A,38B,109C,123C,130C 'set':102C 'state':104C,141C,146C 'still':99C 'taken':44B 'trigger':128C 'underflow':7A,46B,121C,134C 'usag':48B,125C,132C 'vulner':60C 'warn':53B,135C 'write':79C,86C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the kxcjk-1013 IIO accelerometer driver, typically hardware that uses this sensor. The sources do not describe the impact on systems without this hardware, so the rest can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98679","severity":null,"published_at":"2026-10-18T16:17:21+00:00","modified_at":"2026-10-21T13:21:36+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}