Runtime Power Management Vulnerability in Linux Kernel Affecting Qualcomm Iris

CVE-2026-98437

What is CVE-2026-98437?

A vulnerability has been identified in the Linux kernel related to the Qualcomm Iris component, which can lead to runtime power management reference leaks. The issue arises within the iris_enable_power_domains() function, where improper handling can result in a leak of runtime PM usage counts upon failure. Additionally, it is crucial that the pm_runtime_put_sync() function is invoked within the iris_disable_power_domains() function, ensuring that runtime PM references are balanced even if iris_opp_set_rate() encounters an error. This vulnerability highlights the importance of careful power management practices to maintain system stability.

References