CVE-2026-93116

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93116", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.086Z", "datePublished": "2026-09-17T16:11:23.852Z", "dateUpdated": "2026-10-30T12:36:01.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:36:01.447Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: asus-wmi: fix resource leaks on probe failure\n\nDuring driver initialization in asus_wmi_add(), various subsystems are\nregistered sequentially. However, the error path labels are out of order\nrelative to the registration sequence.\n\nSpecifically:\n1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to\n fail_custom_fan_curve. Because this label is placed below fail_sysfs,\n it bypasses the cleanup calls for the input device and sysfs groups,\n which were successfully registered before, leaking those resources.\n2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad.\n Because fail_screenpad is placed below fail_backlight, it bypasses the\n cleanup calls for backlight and rfkill, leaking those resources.\n\nFix these resource leaks by reordering the error path labels in\nasus_wmi_add() to match the exact reverse order of the resource\nallocations."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The leak is created in asus_wmi_add() called from asus_wmi_probe() during asus_wmi_register_driver()'s platform_create_bundle() for asus-nb-wmi/eeepc-wmi module init; leftover rfkill objects are later driven via /dev/rfkill (rfkill_fop_write), not by a network or radio protocol message.\nAC:H - The dangling asus_rfkill exists only when asus_screenpad_init() returns an error other than -ENODEV after asus_wmi_rfkill_init() has registered devices, which requires an ACPI WMI failure from asus_wmi_get_devstate()/asus_wmi_evaluate_method() or backlight_device_register() failure that the attacker cannot induce.\nPR:L - After fail_screenpad skips asus_wmi_rfkill_exit(), the leaked rfkill stays on rfkill_list; rfkill_fop_write() has no capable() check, so a local session user who can open /dev/rfkill (typical laptop rfkill group/uaccess) can send RFKILL_OP_CHANGE and reach asus_rfkill_set() without CAP_SYS_ADMIN.\nUI:N - The attacker themselves writes RFKILL_OP_CHANGE/CHANGE_ALL to /dev/rfkill targeting the leaked asus-wlan/asus-bluetooth rfkill idx; no other user must mount media, plug a device, or confirm a prompt.\nS:U - kfree(asus) on the asus_wmi_add() fail_screenpad path and the later asus_rfkill_query()/asus_rfkill_set() dereference of priv->asus occur in the host kernel; this is not a KVM/Xen guest escape or IOMMU/DMA bypass.\nC:H - fail_screenpad jumps past asus_wmi_rfkill_exit() and then kfree(asus) while rfkill->data still points at the embedded struct asus_rfkill; rfkill_set_block() calls asus_rfkill_query(), which reads priv->asus and priv->dev_id from that freed object, a kernel UAF read.\nI:H - The same dangling rfkill->data is passed to asus_rfkill_set()/asus_rfkill_wlan_set(), which use priv->asus->driver and mutex_lock(&asus->wmi_lock); the leaked backlight_device also keeps bl_get_data()==asus for update_bl_status(), so reclaiming the freed asus_wmi object is a write/control-flow primitive.\nA:H - asus_rfkill_query() and asus_rfkill_set() dereference the kfree'd struct asus_wmi, and asus_rfkill_wlan_set() takes asus->wmi_lock in freed memory, which oopses; fail_custom_fan_curve also skips asus_wmi_input_exit(), leaving a registered input_dev until reboot."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/asus-wmi.c"], "versions": [{"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "lessThan": "72d792c8053f238ae541fdaa90e609548509b65f", "status": "affected", "versionType": "git"}, {"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "lessThan": "959ed35f8c8f07b8dd43c3f917a43ae2f77e4471", "status": "affected", "versionType": "git"}, {"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "lessThan": "8d5999608da60db45949e5459f74f581cdaacd04", "status": "affected", "versionType": "git"}, {"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "lessThan": "8410cd2690d463b60527d00ac8cffea2d5a041f6", "status": "affected", "versionType": "git"}, {"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "lessThan": "3308b8c5f5a28403611a2f5a46f06aabe4f0c661", "status": "affected", "versionType": "git"}, {"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "lessThan": "ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/asus-wmi.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/72d792c8053f238ae541fdaa90e609548509b65f"}, {"url": "https://git.kernel.org/stable/c/959ed35f8c8f07b8dd43c3f917a43ae2f77e4471"}, {"url": "https://git.kernel.org/stable/c/8d5999608da60db45949e5459f74f581cdaacd04"}, {"url": "https://git.kernel.org/stable/c/8410cd2690d463b60527d00ac8cffea2d5a041f6"}, {"url": "https://git.kernel.org/stable/c/3308b8c5f5a28403611a2f5a46f06aabe4f0c661"}, {"url": "https://git.kernel.org/stable/c/ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95"}], "title": "platform/x86: asus-wmi: fix resource leaks on probe failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/platform/x86/asus-wmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "72d792c8053f238ae541fdaa90e609548509b65f", "status": "affected", "version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "versionType": "git"}, {"lessThan": "959ed35f8c8f07b8dd43c3f917a43ae2f77e4471", "status": "affected", "version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "versionType": "git"}, {"lessThan": "8d5999608da60db45949e5459f74f581cdaacd04", "status": "affected", "version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "versionType": "git"}, {"lessThan": "8410cd2690d463b60527d00ac8cffea2d5a041f6", "status": "affected", "version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "versionType": "git"}, {"lessThan": "3308b8c5f5a28403611a2f5a46f06aabe4f0c661", "status": "affected", "version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "versionType": "git"}, {"lessThan": "ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95", "status": "affected", "version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/platform/x86/asus-wmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: asus-wmi: fix resource leaks on probe failure\n\nDuring driver initialization in asus_wmi_add(), various subsystems are\nregistered sequentially. However, the error path labels are out of order\nrelative to the registration sequence.\n\nSpecifically:\n1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to\n fail_custom_fan_curve. Because this label is placed below fail_sysfs,\n it bypasses the cleanup calls for the input device and sysfs groups,\n which were successfully registered before, leaking those resources.\n2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad.\n Because fail_screenpad is placed below fail_backlight, it bypasses the\n cleanup calls for backlight and rfkill, leaking those resources.\n\nFix these resource leaks by reordering the error path labels in\nasus_wmi_add() to match the exact reverse order of the resource\nallocations."}], "id": "CVE-2026-93116", "lastModified": "2026-10-30T13:20:57.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-17T17:18:06.200", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3308b8c5f5a28403611a2f5a46f06aabe4f0c661"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72d792c8053f238ae541fdaa90e609548509b65f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8410cd2690d463b60527d00ac8cffea2d5a041f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d5999608da60db45949e5459f74f581cdaacd04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/959ed35f8c8f07b8dd43c3f917a43ae2f77e4471"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: platform/x86: asus-wmi: fix resource leaks on probe failure", "id": "2536262", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536262"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nplatform/x86: asus-wmi: fix resource leaks on probe failure\nDuring driver initialization in asus_wmi_add(), various subsystems are\nregistered sequentially. However, the error path labels are out of order\nrelative to the registration sequence.\nSpecifically:\n1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to\nfail_custom_fan_curve. Because this label is placed below fail_sysfs,\nit bypasses the cleanup calls for the input device and sysfs groups,\nwhich were successfully registered before, leaking those resources.\n2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad.\nBecause fail_screenpad is placed below fail_backlight, it bypasses the\ncleanup calls for backlight and rfkill, leaking those resources.\nFix these resource leaks by reordering the error path labels in\nasus_wmi_add() to match the exact reverse order of the resource\nallocations.", "A flaw was found in the `asus-wmi` driver of the Linux kernel. During driver initialization, an error handling issue can lead to resource leaks. This occurs because cleanup calls for previously registered subsystems are bypassed when certain initialization functions fail. A local attacker could potentially exploit this to cause system instability or a Denial of Service (DoS) over time due to accumulated resource exhaustion."], "name": "CVE-2026-93116", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93116\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93116\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93116.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0f0ac158d28ff78e75c334e869b1cb8e69372a1f,3308b8c5f5a28403611a2f5a46f06aabe4f0c661)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0f0ac158d28ff78e75c334e869b1cb8e69372a1f,ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-19T09:00:14.734222+00:00", "updated": "2026-09-24T03:30:08.054648+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}