What is the CVSS score of CVE-2026-93116?

CVE-2026-93116 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-93116?

Patch available per vendor advisory. Within 24 hours, confirm whether any ASUS Linux systems are running an affected kernel version containing the platform/x86 asus-wmi driver, check for the vendor or distribution kernel update, and log CVE-2026-93116 exposure; because no exact fix version is provided in the source context, use the patched kernel package from the vendor or Linux distribution rather than attempting manual source changes. Within 7 days, test and deploy the vendor kernel update to affected ASUS endpoints, validating ASUS WMI-dependent functions such as backlight, rfkill, fan-curve, and ScreenPad after reboot; if immediate deployment is not possible, restrict local privileged access to trusted administrators and monitor for kernel resource warnings or probe failures. Within 30 days, verify patch compliance across all affected ASUS Linux assets, update the hardware and kernel inventory, and incorporate the fix into standard kernel maintenance so future ASUS WMI driver CVEs are addressed through routine patch cycles.

Linux Kernel CVE-2026-93116

Q: Which versions of Linux Kernel are affected by CVE-2026-93116?

A resource-leak vulnerability in the Linux kernel's ASUS WMI platform driver (CVE-2026-93116) can cause kernel resource exhaustion on affected ASUS systems when a specific hardware initialization…. A patch is available.

EUVD-2026-82224 HIGH

2026-09-17 Linux

GHSA-5872-jrxc-47c3

Information Disclosure Linux

High

Disputed · 7.0 Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local privileged access
Delivery

Trigger asus-wmi driver (re)probe
Exploit

Force sub-init registration failure
Execution

Error path skips cleanup labels
Impact

Kernel resources leaked (DoS over time)

Vulnerability Assessment

Exploitation Conditions	Requires local access on an ASUS system using the asus-wmi platform driver, and requires a failure during driver probe in asus_wmi_add() - specifically asus_wmi_custom_fan_curve_init() or asus_screenpad_init() must fail so the misordered error-path labels (fail_custom_fan_curve below fail_sysfs; fail_screenpad below fail_backlight) skip cleanup of the already-registered input device, sysfs groups, backlight, and rfkill. Limiting factors: exploitation is not remote (AV:L), needs existing privileges (PR:L), has high complexity/reliance on init failure (AC:H), depends on ASUS-specific hardware/driver presence, and produces only resource leakage rather than memory corruption or disclosure.
Impact	This is a low-real-world-risk issue despite the vendor's 7.0 (HIGH) CVSS score. The vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H already limits it to a local attacker with prior privileges and high attack complexity, and the C:H/I:H/A:H impact triad is not supported by the underlying defect: this is a resource-leak-on-probe-failure bug in the asus-wmi driver's error-path label ordering, not a memory-safety or disclosure primitive. No EPSS score, no CISA KEV listing, and no public POC are provided - all exploitation signals are absent. The bug only manifests when a specific subsystem registration (asus_wmi_custom_fan_curve_init or asus_screenpad_init) FAILS during driver probe, which is not attacker-controllable during normal operation and leaks input-device/sysfs/backlight/rfkill resources rather than corrupting memory. The 'Information Disclosure' tag conflicts with the actual defect (a leak/DoS-class cleanup bug), and the C:H/I:H claim conflicts with the description - verify with vendor. Net: high-CVSS-but-low-real-risk; the realistic worst case is minor resource exhaustion, not confidentiality/integrity loss.
Exploit ScenarioDerived	No public exploit exists. In practice a local user or administrator repeatedly triggering asus-wmi driver load/unload where a sub-init (fan-curve or screenpad) fails would leak input/sysfs/backlight/rfkill resources each time; there is no attacker-driven path to code execution or data disclosure. Because AC:H and PR:L apply, even this benign outcome requires local access and specific failing conditions during probe.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Resource leaks in the Linux kernel's platform/x86 asus-wmi driver on ASUS systems occur when driver probe fails in asus_wmi_add() and the error-path labels are ordered incorrectly relative to the registration sequence, skipping cleanup of already-registered input device, sysfs groups, backlight and rfkill objects. Only local, already-privileged users on ASUS hardware that triggers asus_wmi_custom_fan_curve_init() or asus_screenpad_init() failure can reach the buggy path, and the outcome is leaked kernel resources rather than memory corruption, code execution, or data exposure; no public exploit has been identified at time of analysis and no EPSS score or CISA KEV entry was provided. The low real-world risk is reflected in our independent assessment (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L), which is notably lower than the vendor-published 7.0 HIGH score (AV:L/AC:H/PR:L/UI:N/C:H/I:H/A:H); the discrepancy stems from the vendor rating a driver-init cleanup bug with full confidentiality/integrity impact that the code does not actually deliver.

RemediationAI

Vendor-released patch: fixed in Linux 7.2.6 and 7.3-rc1 via commits 3308b8c5f5a28403611a2f5a46f06aabe4f0c661 and ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95; upgrade the kernel to 7.2.6/7.3-rc1 or later (or the corresponding stable backport for your distribution) and reboot so the corrected asus-wmi driver is loaded. Because the flaw only triggers on a driver probe failure, no meaningful workaround exists on an affected kernel other than avoiding that code path; operators who do not need ASUS vendor features can blacklist the module (modprobe.blacklist=asus_wmi or asus-nb-wmi, or a modprobe.d rule), which prevents the buggy probe from running at all but disables hotkeys, backlight control, rfkill integration and fan-curve/ScreenPad support on those laptops. Systems already stuck in the failure state should be rebooted after patching to reclaim the leaked input-device, sysfs, backlight and rfkill objects, since a failed probe does not release them. No exploitation is known to be required for normal operation and no public exploit has been identified, so patching can follow routine kernel maintenance cadence rather than emergency change control; monitor the upstream commits and distribution advisories (https://git.kernel.org/stable/c/3308b8c5f5a28403611a2f5a46f06aabe4f0c661, https://git.kernel.org/stable/c/ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95) for the backport matching your kernel series.

Affected VersionsENISA

Linux patch: 0

Linux 0f0ac158d28ff78e75c334e869b1cb8e69372a1f <3308b8c5f5a28403611a2f5a46f06aabe4f0c661

Linux patch: 7.2.6

Linux 0f0ac158d28ff78e75c334e869b1cb8e69372a1f <ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95

Linux patch: 7.3-rc1

Linux 5.17

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The platform/x86 asus-wmi driver (asus-wmi / asus-nb-wmi) exposes ASUS laptop vendor functionality to Linux: hotkey input device, sysfs attribute groups, backlight control, rfkill switches, custom fan-curve support and ScreenPad handling. In asus_wmi_add(), these subsystems are registered sequentially, and each successful registration has a corresponding error-path label for unwinding. The labels are ordered incorrectly: fail_custom_fan_curve sits below fail_sysfs, so a failure in asus_wmi_custom_fan_curve_init() jumps past the cleanup of the input device and sysfs groups; fail_screenpad sits below fail_backlight, so a failure in asus_screenpad_init() jumps past the cleanup of backlight and rfkill. Because the labels do not match the reverse order of allocation, partially registered kernel objects (input device, sysfs kobjects, backlight device, rfkill) and their associated memory are leaked instead of released. The accepted fix simply reorders the error labels so unwinding mirrors allocation. No CWE was assigned in the source data; the defect class most closely resembles improper resource shutdown/release (CWE-404/CWE-459), i.e., a cleanup-ordering flaw rather than a memory-safety primitive. The affected CPE is cpe:2.3:a:linux:linux:*:*, and the bug was introduced by commit 0f0ac158d28ff78e75c334e869b1cb8e69372a1f (present since Linux 5.17) and resolved by commits 3308b8c5f5a28403611a2f5a46f06aabe4f0c661 and ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95. The third-party tag 'Information Disclosure' is not supported by the patch contents or by our assessment, which sees only availability/resource-leak impact.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 1.9 LOW

Probe-failure error path is not attacker-driven and only leaks resources, so PR:H/AC:H and impact limited to A:L with no confidentiality or integrity effect.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 18, 2026 - 18:22 NVD

7.0 (HIGH)

Patch available

Sep 17, 2026 - 17:19 EUVD

CVE Published

Sep 17, 2026 - 16:11 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 17, 2026 - 16:11 cve.org

HIGH 7.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: asus-wmi: fix resource leaks on probe failure

During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence.

Specifically:

If asus_wmi_custom_fan_curve_init() fails, the driver jumps to

fail_custom_fan_curve. Because this label is placed below fail_sysfs, it bypasses the cleanup calls for the input device and sysfs groups, which were successfully registered before, leaking those resources.

If asus_screenpad_init() fails, the driver jumps to fail_screenpad.

Because fail_screenpad is placed below fail_backlight, it bypasses the cleanup calls for backlight and rfkill, leaking those resources.

Fix these resource leaks by reordering the error path labels in asus_wmi_add() to match the exact reverse order of the resource allocations.

Executive ViewAI

Why It Matters

A resource-leak vulnerability in the Linux kernel's ASUS WMI platform driver (CVE-2026-93116) can cause kernel resource exhaustion on affected ASUS systems when a specific hardware initialization failure occurs, but only a local high-privileged user can trigger the faulty cleanup path. The vendor rates it HIGH, while our independent assessment finds limited availability impact and no public exploit identified at time of analysis; the main business concern is potential system instability on ASUS Linux endpoints rather than data compromise. Leadership should ensure affected endpoints receive the vendor kernel update through normal patch management and track ASUS Linux hardware in the asset inventory.

Business Impact: Low

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

Low

ASUS laptop-specific WMI platform driver, niche vs general Linux footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +35

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93116 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 ADVISORY https://vuldb.com/vuln/407125 REF https://git.kernel.org/stable/c/3308b8c5f5a28403611a2f5a46f06aabe4f0c661 REF https://git.kernel.org/stable/c/72d792c8053f238ae541fdaa90e609548509b65f REF https://git.kernel.org/stable/c/8410cd2690d463b60527d00ac8cffea2d5a041f6 REF https://git.kernel.org/stable/c/8d5999608da60db45949e5459f74f581cdaacd04 REF https://git.kernel.org/stable/c/959ed35f8c8f07b8dd43c3f917a43ae2f77e4471 REF https://git.kernel.org/stable/c/ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back