In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure… (CVE-2026-98657)

The Linux kernel's iio proximity pulsedlight driver had a flaw where pm_runtime_set_active() failure in probe() led to an incomplete cleanup sequence. Specifically, after iio_device_register() succeeded, an error path did not unregister the device, leaving sysfs and chardev nodes active but referencing freed memory. The patch adds an error path to unregister the iio device before cleaning up the triggered buffer, aligning with the proper teardown order used elsewhere.

This vulnerability results in stale sysfs and character device nodes pointing to freed memory, which can cause use-after-free conditions. This may lead to system instability or potential security issues if an attacker can interact with these stale nodes. However, no known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to properly unregister the iio device on power management setup failure during probe. Users should update to the patched kernel version containing this fix. No additional mitigation steps are indicated.