The gp2ap002 driver for the Linux IIO light subsystem incorrectly handles errors from gp2ap002_get_lux(). It calls pm_runtime_get_sync() before attempting to read a lux value, but if the read fails it returns immediately without executing pm_runtime_put_autosuspend(). This means the runtime power‑management reference is never released, creating a permanent resource leak that prevents the device from autosuspending. The weakness is a resource leak (CWE‑772) and does not provide an attacker any path to arbitrary code execution or data compromise.

The issue resides in the gp2ap002 IIO light driver bundled with the Linux kernel. Any kernel version that includes this driver and predates the commit 0c655d067ac69ee24e2e9d706c54179ea58a43db is affected. The vendor is the Linux kernel project, the product is the Linux kernel itself.

The EPSS score is < 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a very low likelihood of exploitation. The attack vector is local and inferred from the description: an application or system process must trigger gp2ap002_get_lux() and induce a read error. It does not involve network or remote code execution. The primary risk is the prevention of autosuspend, which can increase power consumption and affect battery life or thermal performance in portable or embedded systems without compromising confidentiality or integrity.