SB20261022354 - Missing Release of Resource after Effective Lifetime in Linux kernel tty serial driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022354

SB20261022354 - Missing Release of Resource after Effective Lifetime in Linux kernel tty serial driver

Published: October 22, 2026

Security Bulletin ID SB20261022354
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98746)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to cause clock reference leaks that may degrade system availability.

The vulnerability exists due to missing release of clock references in the Linux kernel ma35d1 serial driver when device probing fails or a serial port is removed. A local privileged user can trigger the affected driver lifecycle paths to leave clock references acquired by of_clk_get() unreleased, potentially degrading system availability through repeated resource leakage.


Remediation

Install update from vendor's website.

References