CVE-2026-98208mmc: sdio_uart: fix xmit_fifo leak when the port table is full
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mmc: sdio_uart: fix xmit_fifo leak when the port table is full sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo. Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8b197a5ce7a7218bb9fc721647ba0d5734f27348 before 9e992d59138fcfaa4bad7cc0750265b0a8bca100; from 8b197a5ce7a7218bb9fc721647ba0d5734f27348 before b97b5b66c93cb4aaf6358727a73fff880a774dfd; 8b197a5ce7a7218bb9fc721647ba0d5734f27348 builds before 8a2c1bf209ba04cbd14153a771724bd5aa522fcd; from 8b197a5ce7a7218bb9fc721647ba0d5734f27348 before 72f4c2b7a48423c708f2c348585419a1b71ab04c; from 8b197a5ce7a7218bb9fc721647ba0d5734f27348 before fd8223c53ad9553b2a349d2a40e19bbc6e60fc48; from 8b197a5ce7a7218bb9fc721647ba0d5734f27348 before ac866db277a4c73e84b4263773652e3aba326249; 8b197a5ce7a7218bb9fc721647ba0d5734f27348 builds before 5e142adbbdc54afbd01fad476c91cded41d22594; from 8b197a5ce7a7218bb9fc721647ba0d5734f27348 before 53823e25793a97d07e6e98e0904bbf74cac8bc76 | CNA record |
References
- https://git.kernel.org/stable/c/9e992d59138fcfaa4bad7cc0750265b0a8bca100
- https://git.kernel.org/stable/c/b97b5b66c93cb4aaf6358727a73fff880a774dfd
- https://git.kernel.org/stable/c/8a2c1bf209ba04cbd14153a771724bd5aa522fcd
- https://git.kernel.org/stable/c/72f4c2b7a48423c708f2c348585419a1b71ab04c
- https://git.kernel.org/stable/c/fd8223c53ad9553b2a349d2a40e19bbc6e60fc48
- https://git.kernel.org/stable/c/ac866db277a4c73e84b4263773652e3aba326249
- https://git.kernel.org/stable/c/5e142adbbdc54afbd01fad476c91cded41d22594
- https://git.kernel.org/stable/c/53823e25793a97d07e6e98e0904bbf74cac8bc76
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.