Cloudanix VulnDB

CVE-2026-98208

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can slowly use up memory when certain hardware connections are repeatedly tried, which might eventually slow down or crash the system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The vulnerability causes a memory leak of the transmit FIFO buffer in the SDIO UART driver when the port table reaches capacity during port addition, as the error path fails to release the allocated FIFO.

Why it matters to the business

Repeated triggering can lead to gradual memory depletion, potentially causing system performance degradation or crashes in Linux-based devices using SDIO UART functionality.

How an attack unfolds

An attacker with local access could repeatedly attempt to register SDIO UART ports to exhaust the table slots, inducing the leak without proper cleanup.

How to fix it

Apply the kernel patch that frees the transmit FIFO in the failure path of sdio_uart_add_port().

How to confirm the fix worked

Review kernel source for the fix in sdio_uart_add_port() and test port addition under full table conditions.

Typical attack path

  1. Identify systems with SDIO UART support
  2. Trigger multiple port addition attempts to fill the table
  3. Repeat to accumulate leaks

How to detect it

Monitor kernel logs for error messages related to sdio_uart_add_port failures and track memory allocation patterns.

What your security team should do

  • Prioritize kernel updates for systems with SDIO UART
  • Monitor for memory usage anomalies in affected drivers

The record

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio_uart: fix xmit_fifo leak when the port table is full sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo. Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.

Affected packages

Ecosystem Package Introduced Fixed