Incorrect behavior order in Linux kernel - CVE-2026-99248
Published: November 3, 2026
Vulnerability identifier: #VU158993
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99248
CWE-ID: CWE-696
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to trigger repeated kernel warnings and potentially disrupt system availability.
The vulnerability exists due to incorrect runtime power management teardown ordering in the Xilinx I2C driver when removing a device. A local privileged user can trigger affected device teardown to cause runtime suspension to disable the device clock before managed resource cleanup disables it again, generating repeated kernel warnings.
Affected software
Linux kernel
How to mitigate CVE-2026-99248
Install security update from vendor's repository.