CVE-2026-98093CWE-404

CVE-2026-98093

High · published September 25, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl_micfil: balance mclk enable/disable

hw_params() enables mclk unconditionally and hw_free() disables it

unconditionally, but the PCM core does not guarantee 1:1 pairing:

hw_free() can run without hw_params(), and hw_params() can be called

multiple times from the SETUP state. This triggers an "already

disabled" WARN() in the first case and leaks an enable reference in

the second, leaving the clock ungateable.

Guard both sides with the existing mclk_flag, as fsl_sai.c does with

mclk_streams.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2026-09-25T15:17Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 6.13, < 6.18.536.18.53
linux/linux_kernel≥ 6.19, < 7.2.77.2.7
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
https://git.kernel.org/stable/c/470db2026a435b79f7ecb4d65523ea16a99d55d8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 10:24Z
    ASoC: fsl_micfil: balance mclk enable/disable
    cvelistv5