CVE-2026-89936

Description

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332_set_value() enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because the regulator is reference counted, changing a channel directly from one non-zero value to another enables it more than once, while a later write of zero disables it only once. The reference count never returns to zero and the regulator is left enabled indefinitely. Only enable the regulator on the transition from zero to non-zero, and only disable it on the transition from non-zero to zero, using the previously stored channel value to detect the edge. Balance the regulator on the I2C error path so the reference count stays consistent if the write fails.

Is your site exposed to CVE-2026-89936?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0022

Probability of exploitation

0.12%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/08ac8d2976d57aa943d64e351c4d0bd8bb0c6de9 https://git.kernel.org/stable/c/1d3a7d7dd3adee19e00be2b2237140f0fe169484 https://git.kernel.org/stable/c/9263b9ad968a563337a60e0eb66e35186e1faf9a https://git.kernel.org/stable/c/9fe22f563b2a0fdb11fd3711a8c39c023629c08a https://git.kernel.org/stable/c/a130404ce0b69ca1438126bd81c1985d3b4d2e6f https://git.kernel.org/stable/c/ae18d2d2ef27a4d04fda6e30c23774513dc9be1e https://git.kernel.org/stable/c/bac0ed8bee651aa841375edf72c6ab1d10ac80c6 https://git.kernel.org/stable/c/f5acb824277a97a5210c454872202bf7f08c75d4

Frequently Asked Questions

What is CVE-2026-89936? +

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332_set_value() enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because the regulator is reference counted, changing a channel directly from one non-zero value to another enables it more than once, while a later write of zero disables it only once. The reference count never returns to zero and the regulator is left enabled indefinitely. Only enable the regulator on the transition from zero to non-zero, and only disable it on the transition from non-zero to zero, using the previously stored channel value to detect the edge. Balance the regulator on the I2C error path so the reference count stays consistent if the write fails.

How do I check if I'm vulnerable to CVE-2026-89936? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.