Improper Following of Specification by Caller in Linux kernel - CVE-2026-98956
Published: October 23, 2026
Vulnerability details
The vulnerability allows a local user to trigger kernel warnings during audio codec power transitions.
The vulnerability exists due to use of a non-sleeping GPIO API in the ASoC ADAU1372 driver's adau1372_set_power() function when controlling a powerdown GPIO whose provider can sleep. A local user can trigger affected codec power transitions to cause the GPIO API to emit kernel warnings.
Affected software
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo
How to mitigate CVE-2026-98956
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1
External References
- https://git.kernel.org/stable/c/47c0c7a051b70d396774d5dc27b23283c28c3555
- https://git.kernel.org/stable/c/58905982b0d912021325f5de84facae86cc0f2f2
- https://git.kernel.org/stable/c/64dd172bbffe6135d79a06ddad53dd2da4d8bd62
- https://git.kernel.org/stable/c/65cd0e21746b812d311e9fac6d473dd62f0ad52a
- https://git.kernel.org/stable/c/6cf4c3c9b7a4df0fe4cc67481b7b251cff781b29