Description
In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: mpu3050-core: fix pm_runtime error handling

The return value of pm_runtime_get_sync() is not checked, allowing
the driver to access hardware that may fail to resume. The device
usage count is also unconditionally incremented. Use
pm_runtime_resume_and_get() which propagates errors and avoids
incrementing the usage count on failure.

In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate()
failure since postdisable does not run when preenable fails.
Published: 2026-05-08
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel mpu3050‑core driver fails to verify the return value of pm_runtime_get_sync(), which means it may attempt to access MPU3050 hardware that has not successfully resumed from a low‑power state. In addition, the driver unconditionally increments the usage counter even when power‑resume fails. This flaw matches CWE‑390 (Run a program after detecting an error) and can cause the kernel to interact with a device that is not in the expected state, leading to unreliable device operation and incorrect power‑state accounting.

Affected Systems

All Linux kernel builds that include the unpatched mpu3050‑core driver are affected. The CVE references list general Linux kernel environments without specifying exact versions, so any kernel configuration containing this driver without the recent patch is potentially vulnerable.

Risk and Exploitability

The EPSS score is less than 1 % and the CVSS score is 5.5, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local access to a system that uses an MPU3050 sensor and the Linux kernel; this inference is drawn from the description indicating the flaw affects kernel power‑management. The flaw does not enable code execution or arbitrary system compromise. The overall risk is limited primarily to unreliable device operation and inaccurate power‑state accounting, and no known public exploits target this issue.

Generated by OpenCVE AI on May 15, 2026 at 18:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the mpu3050‑core driver patch described in the CVE fix
  • Rebuild the kernel or the MPU3050 driver from source that incorporates the corrected pm_runtime_resume_and_get() handling
  • Reboot the system so the updated driver is loaded and the runtime power‑management state is reset

Generated by OpenCVE AI on May 15, 2026 at 18:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4606-1 linux security update
History

Fri, 15 May 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}


Tue, 12 May 2026 03:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-682

Tue, 12 May 2026 00:15:00 +0000


Fri, 08 May 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-682

Fri, 08 May 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050-core: fix pm_runtime error handling The return value of pm_runtime_get_sync() is not checked, allowing the driver to access hardware that may fail to resume. The device usage count is also unconditionally incremented. Use pm_runtime_resume_and_get() which propagates errors and avoids incrementing the usage count on failure. In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate() failure since postdisable does not run when preenable fails.
Title iio: gyro: mpu3050-core: fix pm_runtime error handling
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-11T22:23:00.799Z

Reserved: 2026-05-01T14:12:56.005Z

Link: CVE-2026-43357

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-05-08T15:16:46.477

Modified: 2026-05-15T16:03:01.143

Link: CVE-2026-43357

cve-icon Redhat

Severity :

Publid Date: 2026-05-08T00:00:00Z

Links: CVE-2026-43357 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-15T18:15:05Z

Weaknesses