Skip to main content

Linux CVE-2026-98208

| EUVDEUVD-2026-93136
2026-10-06 Linux GHSA-4c3r-52hj-39rr
View
Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mmc: sdio_uart: fix xmit_fifo leak when the port table is full

sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo.

Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.

Affected VersionsENISA

Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <9e992d59138fcfaa4bad7cc0750265b0a8bca100
Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <72f4c2b7a48423c708f2c348585419a1b71ab04c
Linux patch: 7.3-rc4
Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <8a2c1bf209ba04cbd14153a771724bd5aa522fcd
Linux patch: 6.12.112
Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <ac866db277a4c73e84b4263773652e3aba326249
Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <b97b5b66c93cb4aaf6358727a73fff880a774dfd
Linux patch: 6.1.189
Linux patch: 0
Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <fd8223c53ad9553b2a349d2a40e19bbc6e60fc48
Linux patch: 6.6.158
Linux 2.6.34
Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <5e142adbbdc54afbd01fad476c91cded41d22594
Linux patch: 7.2.8
Linux patch: 5.10.271
Linux 8b197a5ce7a7218bb9fc721647ba0d5734f27348 <53823e25793a97d07e6e98e0904bbf74cac8bc76
Linux patch: 5.15.222
Linux patch: 6.18.54

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Lifecycle Timeline

2
Patch available
Oct 06, 2026 - 10:02 EUVD
CVE Published
Oct 06, 2026 - 08:44 cve.org
UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Data Quality
3 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity Not scored yet
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
No CVSS yet + weak signal (CWE or non-zero EPSS)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy