CVE-2026-98208: Linux kernel · mmc: sdio_uart: fix xmit_fifo leak when the port table is full
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in fd8223c53ad9553b2a349d2a40e19bbc6e60fc48 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 15:59 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in fd8223c53ad9553b2a349d2a40e19bbc6e60fc48, b97b5b66c93cb4aaf6358727a73fff880a774dfd, ac866db277a4c73e84b4263773652e3aba326249 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
This issue has been fixed in the Linux kernel. Users should update to a kernel version that includes the fix identified by the listed commit hashes. No additional mitigation is required once the kernel is updated.
Description
A memory leak vulnerability was identified and fixed in the Linux kernel's sdio_uart driver. The issue occurs when the port table is full, causing the transmit FIFO buffer to be allocated but not freed on error, leading to a resource leak. This was addressed by ensuring the FIFO is freed in the failure path of the sdio_uart_add_port() function.
References
- git.kernel.org/stable/c/9e992d59138fcfaa4bad7cc0750265b0a8bca100 (opens in a new tab)
- git.kernel.org/stable/c/b97b5b66c93cb4aaf6358727a73fff880a774dfd (opens in a new tab)
- git.kernel.org/stable/c/8a2c1bf209ba04cbd14153a771724bd5aa522fcd (opens in a new tab)
- git.kernel.org/stable/c/72f4c2b7a48423c708f2c348585419a1b71ab04c (opens in a new tab)
- git.kernel.org/stable/c/fd8223c53ad9553b2a349d2a40e19bbc6e60fc48 (opens in a new tab)
- git.kernel.org/stable/c/ac866db277a4c73e84b4263773652e3aba326249 (opens in a new tab)
- git.kernel.org/stable/c/5e142adbbdc54afbd01fad476c91cded41d22594 (opens in a new tab)
- git.kernel.org/stable/c/53823e25793a97d07e6e98e0904bbf74cac8bc76 (opens in a new tab)