Improper resource shutdown or release in Linux kernel - CVE-2026-99034

Vulnerability identifier: #VU157469

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-99034

CWE-ID: CWE-404

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to potentially cause a denial of service through incorrect clock handling during device removal.

The vulnerability exists due to improper runtime power management cleanup in sdhci_sprd_remove() in the Linux kernel's Spreadtrum SDHCI driver when removing a runtime-suspended device. A local privileged user can trigger device removal, if permitted, to disable clocks that runtime power management callbacks may have already disabled, potentially disrupting kernel operation.

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

• https://git.kernel.org/stable/c/03244b8713d044425db5dbee08037ecd79b684f9
• https://git.kernel.org/stable/c/3a1caa886d41d9bcc9a402906336eda34a90d323
• https://git.kernel.org/stable/c/605a59639abb9cb63cd7676460461fb0b34756b3
• https://git.kernel.org/stable/c/dbad91a31c482063c0a87c90aa83c9001972c6ac
• https://git.kernel.org/stable/c/e1c6c10a6a70a69e29b04fcc1ebe4b9bcbc7a49a

• Improper resource shutdown or release in Linux kernel mmc host driver
• SUSE update for the Linux Kernel