CVE-2026-98209

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released. Unregister the OF children in reverse order before disabling the parent clock on both paths. Use of_platform_device_destroy() because manual child creation does not set the flag required by of_platform_depopulate(). This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98209

EUVD

EUVD-2026-93137

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c
Linux	Linux	5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of SDHCI child devices during probe failure or removal. When the parent clock and managed resources are released, the child devices remain registered, potentially causing system instability or resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's mmc sdhci-of-aspeed driver and does not have network-based detection methods. Detection requires checking kernel logs for probe failures or improper device unregistration in the SDHCI subsystem. Review dmesg output for errors related to sdhci-of-aspeed or SD card controller initialization.

Impact Analysis

This could lead to system crashes, resource exhaustion, or unexpected behavior in systems using the affected Linux kernel component, particularly those with SDHCI controllers on Aspeed platforms.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel driver issue. No evidence suggests data exposure or privacy risks that would impact regulatory compliance.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If immediate patching is not possible, monitor kernel logs for SDHCI-related errors and avoid using SD card controllers on affected systems until patched.

Hi! I’m here to help you understand CVE-2026-98209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70