CVE-2026-93116

CVE-2026-93116

High · published September 17, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
5.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: asus-wmi: fix resource leaks on probe failure

During driver initialization in asus_wmi_add(), various subsystems are

registered sequentially. However, the error path labels are out of order

relative to the registration sequence.

Specifically:

1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to

fail_custom_fan_curve. Because this label is placed below fail_sysfs,

it bypasses the cleanup calls for the input device and sysfs groups,

which were successfully registered before, leaking those resources.

2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad.

Because fail_screenpad is placed below fail_backlight, it bypasses the

cleanup calls for backlight and rfkill, leaking those resources.

Fix these resource leaks by reordering the error path labels in

asus_wmi_add() to match the exact reverse order of the resource

allocations.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00163 · 5.2th percentile
Published
2026-09-17T21:18Z
References (5)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:11Z
    platform/x86: asus-wmi: fix resource leaks on probe failure
    cvelistv5