CVE-2026-89934: Linux Linux

iio: light: ltrf216a: fix runtime PM reference leak in error path

No CVSS scoreEPSS 0.0023 · 13th percentile

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:32 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before a065b8b596d23de4b2e108d78ba34d17e723c865 git affected 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before 4bf5525c6ff4a9f8df35bcc227a918b6396b2cb5 git affected 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before c4f003d8578f5718fe1ec332bc89f9ff69fd205b git affected 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before 0614928a3eda35bddd8c2f02311e286b59bbe746 git affected 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before 80e7381e8cccb543397572af153865f34aaf4353 git affected 83f0bcd40d5cf88870d2f2bb8b97c772b92a3d1f to before c132aef0e757a39036b1d40faf0569f2e343b13e git Other versions: unaffected
Linux	Linux	affected 6.1 unaffected before 6.1 semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.110 to 6.12., inclusive semver unaffected 6.18.51 to 6.18., inclusive semver unaffected 7.2.5 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers

CVE-2026-89934

CNA

Linux

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The Linux kernel IIO light driver for the LTRF216A sensor is affected in versions from 6.1 up to the fixes listed in the source; kernels before 6.1 are not affected. The description says a failed sensor read leaves a runtime power-management reference unreleased, so the device cannot autosuspend afterward. The source does not describe any attacker capability, severity, or effect beyond this power-management imbalance. Upgrade to a fixed kernel release: 6.1.191 or later in the 6.1 series, 6.6.160 or later in 6.6, 6.12.110 or later in 6.12, or 6.18.51 or later in 6.18.

Written 12 Nov 2026.

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0023, the 13th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.