CVE-2026-98208

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio_uart: fix xmit_fifo leak when the port table is full sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo. Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98208

EUVD

EUVD-2026-93136

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	8b197a5ce7a7218bb9fc721647ba0d5734f27348
Linux	Linux	2.6.34

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's SDIO UART driver. When adding a new serial port via sdio_uart_add_port(), the transmit FIFO is allocated before checking if there are available slots. If all slots are full, the function returns an error but fails to free the allocated FIFO, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's SDIO UART driver and may not have direct network detection methods. Check kernel logs for errors related to sdio_uart or mmc subsystem using dmesg | grep sdio_uart or journalctl -k | grep sdio_uart.

Impact Analysis

The impact is limited to systems using SDIO UART devices. The memory leak could gradually consume system memory over time, potentially leading to performance degradation or system instability if many ports are repeatedly added and removed.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory leak in the Linux kernel's SDIO UART driver that could lead to resource exhaustion but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel updates from your distribution and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70