SB20261015159 - Improper control of a resource through its lifetime in Linux kernel mmc host driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261015159

SB20261015159 - Improper control of a resource through its lifetime in Linux kernel mmc host driver

Published: October 15, 2026

Security Bulletin ID SB20261015159
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98209)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to leave SDHCI child devices registered after their parent resources have been released.

The vulnerability exists due to improper resource lifecycle management in the Aspeed SDHCI controller driver when probe failure or device removal occurs. A local user can trigger these lifecycle paths to leave SDHCI child devices registered after their parent resources have been released.

The released parent resources include the controller clock and managed resources.


Remediation

Install update from vendor's website.

References