Is there a patch available for EUVD-2026-93137?

Yes, a patch is available for EUVD-2026-93137. Update the affected software to the latest version immediately.

Linux EUVD-2026-93137

| CVE-2026-98209

2026-10-06 Linux

GHSA-q4rm-j75j-m3m8

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mmc: sdhci-of-aspeed: Remove children before releasing SDC resources

Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released.

Unregister the OF children in reverse order before disabling the parent clock on both paths. Use of_platform_device_destroy() because manual child creation does not set the flag required by of_platform_depopulate().

This issue was identified during our ongoing static-analysis research while reviewing kernel code.

Affected VersionsENISA

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <4396d70bb7fec531bcf934fed016b2f3300c670b

Linux patch: 5.10.271

Linux patch: 6.18.54

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <b84d29f2541c8adb768e468388dbaa4bc25ef157

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <356b4b3b28a8ecd2a6c66d3b9666686315337df1

Linux patch: 5.15.222

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <6b22b4d29e4fc1d2de2e4d7174925d68220165fb

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <15b5ffd8af2dd46856da57467eb6e0f90d8ada51

Linux patch: 7.2.8

Linux patch: 6.12.112

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <67e8117df8547433989a6ac1545a68848d0a289f

Linux 5.4

Linux patch: 6.6.158

Linux patch: 7.3-rc4

Linux patch: 0

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <7eb896617a6db846b18596c10ca9f8900a73013e

Linux patch: 6.1.189

Linux bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c <bc5e79a5a5651588f3a93bef7815e4e86f78962c

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

CVE Published

Oct 06, 2026 - 08:44 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Threat Intel

1 sources

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS NEWS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.