# iio: light: ltrf216a: fix runtime PM reference leak in error path CVE record · `CVE-2026-89934` - **Identifiers:** `CVE-2026-89934` - **State:** Confirmed - **Severity:** No CVSS score - **Critical:** No - **CNA:** Linux - **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md) - **Published:** 16 Sept 2026 - **Updated:** 30 Oct 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:32 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: Linux. Product: Linux. - affected: `83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before a065b8b596d23de4b2e108d78ba34d17e723c865` (git) - affected: `83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before 4bf5525c6ff4a9f8df35bcc227a918b6396b2cb5` (git) - affected: `83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before c4f003d8578f5718fe1ec332bc89f9ff69fd205b` (git) - affected: `83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before 0614928a3eda35bddd8c2f02311e286b59bbe746` (git) - affected: `83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before 80e7381e8cccb543397572af153865f34aaf4353` (git) - affected: `83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before c132aef0e757a39036b1d40faf0569f2e343b13e` (git) - Other versions: unaffected - Vendor: Linux. Product: Linux. - affected: `6.1` - unaffected: `before 6.1` (semver) - unaffected: `6.1.191 to 6.1.*, inclusive` (semver) - unaffected: `6.6.160 to 6.6.*, inclusive` (semver) - unaffected: `6.12.110 to 6.12.*, inclusive` (semver) - unaffected: `6.18.51 to 6.18.*, inclusive` (semver) - unaffected: `7.2.5 to 7.2.*, inclusive` (semver) - unaffected: `7.3 to *, inclusive` (original_commit_for_fix) - Other versions: affected ## Machine-written summary Summary written by Claude Haiku from the source advisory. Not reviewed by a person. > The Linux kernel IIO light driver for the LTRF216A sensor is affected in versions from 6.1 up to the fixes listed in the source; kernels before 6.1 are not affected. The description says a failed sensor read leaves a runtime power-management reference unreleased, so the device cannot autosuspend afterward. The source does not describe any attacker capability, severity, or effect beyond this power-management imbalance. Upgrade to a fixed kernel release: 6.1.191 or later in the 6.1 series, 6.6.160 or later in 6.6, 6.12.110 or later in 6.12, or 6.18.51 or later in 6.18. Written 12 Nov 2026. ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation No source has published a CVSS score for this record yet. - **CISA KEV:** Not listed. - **EPSS:** 0.0023, the 13th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2026-89934](https://www.cve.org/CVERecord?id=CVE-2026-89934) - [NVD: CVE-2026-89934](https://nvd.nist.gov/vuln/detail/CVE-2026-89934) ### References from the CNA - - - - - - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .