Incomplete cleanup in Linux kernel - CVE-2026-98671

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU157001

Incomplete cleanup in Linux kernel - CVE-2026-98671

Published: October 22, 2026


Vulnerability identifier: #VU157001
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98671
CWE-ID: CWE-459
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to potentially cause a denial of service through incomplete driver cleanup.

The vulnerability exists due to incomplete cleanup in the Linux kernel sun4i-gpadc-iio driver's probe function when thermal zone registration fails with an error other than -ENODEV. A local user can potentially trigger this failure path to leave the IIO map array registered and runtime power management enabled, which may disrupt system operation.


Affected software

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

How to mitigate CVE-2026-98671

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

External References

Related Security Bulletins