Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98779
Published: October 22, 2026
Vulnerability details
The vulnerability allows a local user to cause a device resource leak that may lead to a denial of service.
The vulnerability exists due to missing release of registered child platform devices in the AMDGPU driver's acp_hw_init() function when power-domain attachment fails or ACP reset or clock enable operations time out after successful MFD device registration. A local user can potentially trigger an affected initialization failure to leave child devices registered and consume system resources, which may impair system availability.
Affected software
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo
How to mitigate CVE-2026-98779
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1
External References
- https://git.kernel.org/stable/c/2b9a53940a2bc063ea4cd09ee49220a503a0170c
- https://git.kernel.org/stable/c/587469076e4ffb617f7ad1a0c4a13072a3e87113
- https://git.kernel.org/stable/c/abf854513bc19e6e24d45353ac99ec5627ee0acc
- https://git.kernel.org/stable/c/d700c26ed64bd3c26e4aa7679b9d5f3333c3747a
- https://git.kernel.org/stable/c/f0013046151b7467e62c471c1c83d63ea255799c