The Linux kernel vulnerability CVE-2026-64499 affects the iio adc ti-ads1119 driver. The function ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion. If the i2c_smbus_write_byte() call fails, the function returns immediately without calling the matching postdisable callback, causing the runtime PM usage counter to remain elevated. This results in a PM reference leak, potentially leaving the device runtime-active indefinitely. The fix involves storing the I2C transfer result and dropping the runtime PM reference on failure before returning the error.

The vulnerability causes a power management reference leak that may keep the device runtime-active indefinitely, potentially leading to increased power consumption or resource mismanagement. There is no indication of direct security compromise or code execution from this issue.

A fix for this vulnerability has been implemented in the Linux kernel source code. Users should update to a kernel version that includes this fix. Since this is a kernel-level bug fix, applying the official kernel update is the recommended remediation. Patch status is not explicitly stated here; check the Linux kernel vendor advisory or source repository for the exact fixed version and update accordingly.