SB20261029146 - Missing Release of Resource after Effective Lifetime in Linux kernel i2c busses driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99161)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a clock resource leak that may degrade system availability.

The vulnerability exists due to failure to release clock references in the Linux kernel's wmt_i2c_probe() function when a subsequent probe operation fails or the module is unloaded. A local privileged user can potentially trigger these driver lifecycle conditions to leave references acquired through of_clk_get() unreleased, which may exhaust resources over repeated occurrences.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1875de656370c89b99a150d220df876288ee0344
• https://git.kernel.org/stable/c/5d476bb76b7d72d8b7ed04a9c614900b097e3af7
• https://git.kernel.org/stable/c/aaabefc79b0ff0018e8e3832169bbe359d0551fc