{"cve":"CVE-2026-90249","nvd":{"published":"2026-09-17T17:17:21.097","modified":"2026-10-19T09:19:15.430","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes\n\nThe IIO core does not filter duplicate writes to the event enable\nattribute, so writing the same value twice invokes\nwrite_event_config() twice. Enabling twice leaks a runtime PM\nreference, preventing the device from ever suspending again;\ndisabling twice underflows the usage count and triggers a\n\"Runtime PM usage count underflow\" warning.\n\nBail out early when the requested state matches the current state.\nWhile at it, switch to pm_runtime_resume_and_get() so a failed\nresume is propagated to userspace instead of silently marking the\nevent enabled.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0fc740c25c9abb25113398ebb58e2f2ce57741a7","https://git.kernel.org/stable/c/470edb012b1d9a4fba1cd59e329e60f0798c791a","https://git.kernel.org/stable/c/56fe8e5f313a64e458bb6f8b982de925345e21a7","https://git.kernel.org/stable/c/579c049b4cb6fc72ce2c505fc5334540be0efcd3","https://git.kernel.org/stable/c/685d9d1e5c47e024413981fb7eddab86132b04a1"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90249","score":0.0022,"percentile":0.12368,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}