Cloudanix VulnDB

CVE-2026-99161

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a Linux driver for certain I2C hardware could waste system resources if the driver is loaded and unloaded many times, and updating the software fixes it automatically.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The flaw causes a clock resource reference count leak in the WMT I2C controller driver probe routine when using of_clk_get() without corresponding clk_put() on error paths or module unload.

Why it matters to the business

Repeated driver loading or probe failures can lead to gradual depletion of kernel clock resources, potentially causing system instability or preventing proper device initialization over time.

How an attack unfolds

An attacker with the ability to trigger repeated module loads, unloads, or probe failures could exhaust clock references, though no active exploitation has been observed.

How to fix it

Update to a kernel version that incorporates the fix replacing of_clk_get() with devm_clk_get() in the wmt_i2c_probe function.

How to confirm the fix worked

Inspect the driver source for use of devm_clk_get() instead of of_clk_get() without manual clk_put().

Typical attack path

  1. Identify systems using the viai2c-wmt I2C driver
  2. Trigger conditions leading to probe failures or module reloads
  3. Accumulate leaks to exhaust resources

How to detect it

Look for evidence of repeated module loads in system logs or signs of resource leaks in kernel messages.

What your security team should do

  • Apply the kernel patch or upgrade to fixed version promptly
  • Monitor for unusual I2C driver behavior
  • Audit systems for affected driver usage

The record

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clk_put(), leading to a resource leak. Switch to devm_clk_get() so that the clock is automatically managed and released.

Affected packages

Ecosystem Package Introduced Fixed