CVE-2026-23283: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23283 is a PM runtime reference leak vulnerability in the Linux kernel's regulator/fp9931 driver. Specifically, in the fp9931_hwmon_read() function, if regmap_read() fails, the function returns an error code without calling pm_runtime_put_autosuspend(), causing a reference count leak. The vulnerability affects Linux kernel versions 6.19 through 6.19.6 and 7.0-rc1, and was disclosed on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-911 (Improper Update of Reference Count). In fp9931_hwmon_read(), the function calls pm_runtime_get_sync() to increment the PM runtime reference count before performing a hardware monitor read via regmap_read(). When regmap_read() returns an error, the function exits immediately without calling the corresponding pm_runtime_put_autosuspend() to decrement the reference count, leaving the PM subsystem in an inconsistent state. This is a local vulnerability requiring low-privileged access, with no user interaction needed. The fix involves adding the missing pm_runtime_put_autosuspend() call on the error path, as implemented in kernel commits ada571018d54 and 0902010c8d16 (Red Hat Bugzilla, Feedly).

Successful triggering of this bug causes accumulated PM runtime references that prevent the fp9931 regulator device from entering low-power (autosuspend) states. On systems using fp9931 regulator hardware, repeated failures in hardware monitoring reads can degrade system performance and battery life over time by preventing proper power management. There is no confidentiality or integrity impact; the sole consequence is an availability impact (CVSS A:H) through degraded power management functionality (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for this vulnerability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require local, low-privileged access to a system running an affected kernel version with fp9931 regulator hardware (Feedly).

The vulnerability is patched in Linux kernel versions 6.19.7 and 7.0-rc2. The fixes are available via upstream commits ada571018d54c2381bab7c290577114f9667cda7 (stable branch) and 0902010c8d163f7b62e655efda1a843529152c7c. Administrators running kernel 6.19.x on systems with fp9931 regulator hardware should upgrade to 6.19.7 or later. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (Red Hat Bugzilla, Feedly).