Improper control of a resource through its lifetime in Linux kernel - CVE-2026-98209
Published: October 15, 2026
Vulnerability identifier: #VU155943
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98209
CWE-ID: CWE-664
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to leave SDHCI child devices registered after their parent resources have been released.
The vulnerability exists due to improper resource lifecycle management in the Aspeed SDHCI controller driver when probe failure or device removal occurs. A local user can trigger these lifecycle paths to leave SDHCI child devices registered after their parent resources have been released.
The released parent resources include the controller clock and managed resources.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98209
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/15b5ffd8af2dd46856da57467eb6e0f90d8ada51
- https://git.kernel.org/stable/c/356b4b3b28a8ecd2a6c66d3b9666686315337df1
- https://git.kernel.org/stable/c/4396d70bb7fec531bcf934fed016b2f3300c670b
- https://git.kernel.org/stable/c/67e8117df8547433989a6ac1545a68848d0a289f
- https://git.kernel.org/stable/c/6b22b4d29e4fc1d2de2e4d7174925d68220165fb
- https://git.kernel.org/stable/c/7eb896617a6db846b18596c10ca9f8900a73013e
- https://git.kernel.org/stable/c/b84d29f2541c8adb768e468388dbaa4bc25ef157
- https://git.kernel.org/stable/c/bc5e79a5a5651588f3a93bef7815e4e86f78962c