Cloudanix VulnDB

CVE-2026-98410

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug can make certain computers unexpectedly restart themselves when they try to sleep or wake up.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The da9063 watchdog driver fails to disable the hardware timer during suspend when WDOG_HW_RUNNING is set in probe but watchdog_active() remains false, allowing the counter to continue and trigger an unintended reset.

Why it matters to the business

Systems may experience unplanned reboots during suspend or resume cycles, leading to service interruptions and reduced availability on affected embedded or server platforms.

How an attack unfolds

An attacker with local access triggers a system suspend (via power management interfaces) on a machine where the watchdog was armed by the driver but never opened from userspace; the suspend handler skips disablement, the timer expires, and the system resets.

How to fix it

Update the Linux kernel to a version containing the fix for da9063_wdt_suspend/resume handling of WDOG_HW_RUNNING; rebuild and deploy the updated kernel image on affected hardware.

How to confirm the fix worked

Confirm the kernel source includes checks for both watchdog_active() and WDOG_HW_RUNNING in da9063_wdt_suspend(); test suspend/resume cycles with the watchdog armed but unopened from userspace to verify no spurious reset occurs.

Typical attack path

  1. Gain local access on target Linux system using da9063 watchdog
  2. Ensure watchdog is configured to run via driver probe without userspace open
  3. Invoke system suspend through power management or scripted trigger
  4. Watchdog remains active through suspend, expires, and forces reset

How to detect it

Review kernel logs around suspend/resume events for watchdog timeout messages or unexpected reboot entries; correlate with da9063 probe messages showing WDOG_HW_RUNNING without subsequent userspace open.

What your security team should do

  • Prioritize kernel updates on all da9063-equipped devices within maintenance windows
  • Monitor vendor advisories for backported patches to distribution kernels
  • Add power-management regression tests that arm the watchdog without opening the device file

The record

In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog da9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(), when the watchdog is left running by the driver sets WDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the device, so WDOG_ACTIVE remains cleared, the wdt_disable() will not be executed in da9063_wdt_suspend. In this case, the suspend callback is a no-op and the watchdog keeps counting during system suspend, leading to an unexpected system reset. Check WDOG_HW_RUNNING and wdd，can fix this issue.

Affected packages

Ecosystem Package Introduced Fixed