FKIE_CVE-2026-98208

Vulnerability from fkie_nvd - Published: 2026-10-06 09:18 - Updated: 2026-10-06 09:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: mmc: sdio_uart: fix xmit_fifo leak when the port table is full sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo. Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/53823e25793a97d07e6e98e0904bbf74cac8bc76
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5e142adbbdc54afbd01fad476c91cded41d22594
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/72f4c2b7a48423c708f2c348585419a1b71ab04c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8a2c1bf209ba04cbd14153a771724bd5aa522fcd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9e992d59138fcfaa4bad7cc0750265b0a8bca100
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ac866db277a4c73e84b4263773652e3aba326249
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b97b5b66c93cb4aaf6358727a73fff880a774dfd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fd8223c53ad9553b2a349d2a40e19bbc6e60fc48
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/core/sdio_uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e992d59138fcfaa4bad7cc0750265b0a8bca100",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            },
            {
              "lessThan": "b97b5b66c93cb4aaf6358727a73fff880a774dfd",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            },
            {
              "lessThan": "8a2c1bf209ba04cbd14153a771724bd5aa522fcd",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            },
            {
              "lessThan": "72f4c2b7a48423c708f2c348585419a1b71ab04c",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            },
            {
              "lessThan": "fd8223c53ad9553b2a349d2a40e19bbc6e60fc48",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            },
            {
              "lessThan": "ac866db277a4c73e84b4263773652e3aba326249",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            },
            {
              "lessThan": "5e142adbbdc54afbd01fad476c91cded41d22594",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            },
            {
              "lessThan": "53823e25793a97d07e6e98e0904bbf74cac8bc76",
              "status": "affected",
              "version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/core/sdio_uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdio_uart: fix xmit_fifo leak when the port table is full\n\nsdio_uart_add_port() allocates the transmit fifo before claiming a\nslot in sdio_uart_table[].  When all UART_NR slots are taken, it\nreturns -EBUSY with the fifo still allocated, but the probe error\npath only kfree()s the port, leaking the transmit fifo.\n\nFree the fifo in the failure path of sdio_uart_add_port() itself so\nthe function retains nothing on error."
    }
  ],
  "id": "CVE-2026-98208",
  "lastModified": "2026-10-06T09:18:07.017",
  "metrics": {},
  "published": "2026-10-06T09:18:07.017",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/53823e25793a97d07e6e98e0904bbf74cac8bc76"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5e142adbbdc54afbd01fad476c91cded41d22594"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/72f4c2b7a48423c708f2c348585419a1b71ab04c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8a2c1bf209ba04cbd14153a771724bd5aa522fcd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9e992d59138fcfaa4bad7cc0750265b0a8bca100"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ac866db277a4c73e84b4263773652e3aba326249"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b97b5b66c93cb4aaf6358727a73fff880a774dfd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fd8223c53ad9553b2a349d2a40e19bbc6e60fc48"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.