SB20260928142 - Missing Release of Resource after Effective Lifetime in Linux kernel intel avs

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98054)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak a module reference.

The vulnerability exists due to missing module reference release on error paths in the ASoC Intel AVS strace_open debugfs handler when opening the strace debugfs file. A local user can trigger an error after a module reference is acquired to leak a module reference.

The issue is triggered if the trace FIFO is already initialized or its allocation fails.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/23ebd4ed5799340f1d2193195c97f61d39aa9899
• https://git.kernel.org/stable/c/3fcf670f023d47e4eb970fb886ee562b5bdfbee7
• https://git.kernel.org/stable/c/60b396b2aeca303bc468937d2b44a82399f37b3c
• https://git.kernel.org/stable/c/d4fa6f94b91137e329ea3f5b360e140b227bb696