Linux: Improper Resource Shutdown or Release
CVE-2026-98093 is a high-severity improper resource shutdown or release vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 470db2026a435b79f7ecb4d65523ea16a99d55d8, fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5, d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 470db2026a435b79f7ecb4d65523ea16a99d55d8 or fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5 or d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.18.53 or 7.2.7, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | b47024dc624bcffb89d238f4a5b490363cea2a1e up to, but not including, 470db2026a435b79f7ecb4d65523ea16a99d55d8; b47024dc624bcffb89d238f4a5b490363cea2a1e up to, but not including, fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5; b47024dc624bcffb89d238f4a5b490363cea2a1e up to, but not including, d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56; 6.13 | 470db2026a435b79f7ecb4d65523ea16a99d55d8, fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5, d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56 |
| Linux | Linux Kernel | 6.13 up to, but not including, 6.18.53; 6.19 up to, but not including, 7.2.7; 7.3 | 6.18.53, 7.2.7 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_micfil: balance mclk enable/disable hw_params() enables mclk unconditionally and hw_free() disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hw_free() can run without hw_params(), and hw_params() can be called multiple times from the SETUP state. This triggers an "already disabled" WARN() in the first case and leaks an enable reference in the second, leaving the clock ungateable. Guard both sides with the existing mclk_flag, as fsl_sai.c does with mclk_streams.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
How developers prevent this class of flaw
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
- It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
- Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
More Improper Resource Shutdown or Release vulnerabilities (CWE-404)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Improper Resource Shutdown or Release vulnerabilities
- 9.1 Critical severity
- 7.8 High severity
- 9.8 Critical severity
- 8.8 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.