CVE-2026-98208 mmc: sdio_uart: fix xmit_fifo leak when the port table is full
A memory leak in the Linux kernel SDIO UART driver allows local attackers to exhaust system memory, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98208?
CVE-2026-98208 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo.
Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.
Which versions are affected by CVE-2026-98208?
How do I fix CVE-2026-98208?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98208 being exploited?
There is no known exploitation of CVE-2026-98208 in the wild and no public exploit code.
Sources
Also known as AZL-106239, BELL-CVE-2026-98208, DEBIAN-CVE-2026-98208, GHSA-4c3r-52hj-39rr, UBUNTU-CVE-2026-98208.