Improper control of a resource through its lifetime in Linux kernel - CVE-2026-98933

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU157570

Improper control of a resource through its lifetime in Linux kernel - CVE-2026-98933

Published: October 23, 2026


Vulnerability identifier: #VU157570
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98933
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service on affected AMD platforms.

The vulnerability exists due to excessive retention of a runtime power-management reference in the Linux kernel USB3 root hub handling code when resuming a hub on affected AMD platforms. A local user can repeatedly trigger USB subsystem wakeups to cause system crashes because the reference remains held for 200 milliseconds after each resume.


Affected software

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

How to mitigate CVE-2026-98933

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

External References

Related Security Bulletins