Linux Kernel CVE-2026-98093

Requires a kernel built with the NXP i.MX fsl_micfil ASoC driver (digital PDM microphone interface) present and in use, and local access to the corresponding ALSA PCM device to drive the state machine into the unbalanced paths - specifically triggering hw_free() without a preceding hw_params(), or calling hw_params() multiple times from the SETUP state. Limiting factors: this affects only NXP i.MX platforms that enable fsl_micfil (not generic x86/server kernels), local device access is required, and the observed result is a kernel WARN() and a leaked MCLK enable reference leaving the clock ungateable - there is no described memory-corruption or code-execution primitive.

This is a resource-management defect (CWE-404) in the NXP i.MX fsl_micfil ASoC driver: hw_params() enables MCLK unconditionally and hw_free() disables it unconditionally, so the unguarded paths produce an "already disabled" WARN() or leak an enable reference that leaves the clock ungateable. The input CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) appears inflated for the described behavior: a clock enable/disable imbalance that triggers a WARN splat and prevents clock gating has at most a minor local availability/power-management impact, not high confidentiality and integrity impact - this is the standard conservatively-high score the kernel CVE process auto-assigns, and it should be treated with skepticism. The supporting signals all point to low real-world risk: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no exploit or PoC reference is present (the only references are the kernel.org stable fix commits and the NVD page). The vuln.today 'this_week' priority reflects routine stable-tree patch hygiene rather than active threat. Net: this is a low-priority, defense-in-depth kernel fix for a specific embedded audio driver, not an urgent broadly-exploitable vulnerability; the headline CVSS overstates the practical impact - verify the C/I/A rating against the described WARN/clock-leak behavior before prioritizing on score alone.

On an NXP i.MX device whose kernel includes the fsl_micfil PDM-microphone driver, a local user with access to the audio PCM device drives the ALSA state machine so that hw_free() runs without a matching hw_params(), or calls hw_params() repeatedly from the SETUP state. This triggers a kernel WARN() or leaks an MCLK enable reference, leaving the clock permanently ungated (a noisy log splat and a minor power/availability nuisance). No public exploit or PoC is identified at time of analysis.