CVE-2026-97969

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97969", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.207Z", "datePublished": "2026-09-25T10:23:10.333Z", "dateUpdated": "2026-10-19T09:11:35.081Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:11:35.081Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n\nmsc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start() which\nintroduces two severe bugs:\n\n1. If the watchdog is already active, calling start() again will\n increase the reference count of the clock again. However stop() is\n only called once, the reference count is unbalance.\n2. If the watchdog is stopped, calling settimeout() will start\n the hardware timer accidentally.\n\nFactor out the register-writing logic into a helper function. Only call\nit in settimeout() if the watchdog is running. Otherwise, simply update\n`wdev->timeout`."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/watchdog/msc313e_wdt.c"], "versions": [{"version": "e9800b7994642a794afd4894f072541c14277ce8", "lessThan": "68665016c7b777b44e27b6b0c1e6524c28ebe40a", "status": "affected", "versionType": "git"}, {"version": "e9800b7994642a794afd4894f072541c14277ce8", "lessThan": "77ef2aa8b46876ca9935f32dd874c517ccf5d880", "status": "affected", "versionType": "git"}, {"version": "e9800b7994642a794afd4894f072541c14277ce8", "lessThan": "a1dd0817776ea2a870ba2347001af13ddd4cb321", "status": "affected", "versionType": "git"}, {"version": "e9800b7994642a794afd4894f072541c14277ce8", "lessThan": "2152a13ee2a9af09a668ebd053a8dbf771dadb80", "status": "affected", "versionType": "git"}, {"version": "e9800b7994642a794afd4894f072541c14277ce8", "lessThan": "2abf99a57b0b71b2b97745981f4039370ab78044", "status": "affected", "versionType": "git"}, {"version": "e9800b7994642a794afd4894f072541c14277ce8", "lessThan": "faf1eb2895c87a8c0fb920439dddc7e0d97c6a69", "status": "affected", "versionType": "git"}, {"version": "e9800b7994642a794afd4894f072541c14277ce8", "lessThan": "3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/watchdog/msc313e_wdt.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/68665016c7b777b44e27b6b0c1e6524c28ebe40a"}, {"url": "https://git.kernel.org/stable/c/77ef2aa8b46876ca9935f32dd874c517ccf5d880"}, {"url": "https://git.kernel.org/stable/c/a1dd0817776ea2a870ba2347001af13ddd4cb321"}, {"url": "https://git.kernel.org/stable/c/2152a13ee2a9af09a668ebd053a8dbf771dadb80"}, {"url": "https://git.kernel.org/stable/c/2abf99a57b0b71b2b97745981f4039370ab78044"}, {"url": "https://git.kernel.org/stable/c/faf1eb2895c87a8c0fb920439dddc7e0d97c6a69"}, {"url": "https://git.kernel.org/stable/c/3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0"}], "title": "watchdog: msc313e: Fix clock leak and spurious timer in settimeout()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/watchdog/msc313e_wdt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "68665016c7b777b44e27b6b0c1e6524c28ebe40a", "status": "affected", "version": "e9800b7994642a794afd4894f072541c14277ce8", "versionType": "git"}, {"lessThan": "77ef2aa8b46876ca9935f32dd874c517ccf5d880", "status": "affected", "version": "e9800b7994642a794afd4894f072541c14277ce8", "versionType": "git"}, {"lessThan": "a1dd0817776ea2a870ba2347001af13ddd4cb321", "status": "affected", "version": "e9800b7994642a794afd4894f072541c14277ce8", "versionType": "git"}, {"lessThan": "2152a13ee2a9af09a668ebd053a8dbf771dadb80", "status": "affected", "version": "e9800b7994642a794afd4894f072541c14277ce8", "versionType": "git"}, {"lessThan": "2abf99a57b0b71b2b97745981f4039370ab78044", "status": "affected", "version": "e9800b7994642a794afd4894f072541c14277ce8", "versionType": "git"}, {"lessThan": "faf1eb2895c87a8c0fb920439dddc7e0d97c6a69", "status": "affected", "version": "e9800b7994642a794afd4894f072541c14277ce8", "versionType": "git"}, {"lessThan": "3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0", "status": "affected", "version": "e9800b7994642a794afd4894f072541c14277ce8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/watchdog/msc313e_wdt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n\nmsc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start() which\nintroduces two severe bugs:\n\n1. If the watchdog is already active, calling start() again will\n increase the reference count of the clock again. However stop() is\n only called once, the reference count is unbalance.\n2. If the watchdog is stopped, calling settimeout() will start\n the hardware timer accidentally.\n\nFactor out the register-writing logic into a helper function. Only call\nit in settimeout() if the watchdog is running. Otherwise, simply update\n`wdev->timeout`."}], "id": "CVE-2026-97969", "lastModified": "2026-10-19T10:17:48.263", "metrics": {}, "published": "2026-09-25T11:17:24.767", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2152a13ee2a9af09a668ebd053a8dbf771dadb80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2abf99a57b0b71b2b97745981f4039370ab78044"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/68665016c7b777b44e27b6b0c1e6524c28ebe40a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/77ef2aa8b46876ca9935f32dd874c517ccf5d880"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1dd0817776ea2a870ba2347001af13ddd4cb321"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/faf1eb2895c87a8c0fb920439dddc7e0d97c6a69"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: watchdog: msc313e: Fix clock leak and spurious timer in settimeout()", "id": "2541232", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541232"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwatchdog: msc313e: Fix clock leak and spurious timer in settimeout()\nmsc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start() which\nintroduces two severe bugs:\n1. If the watchdog is already active, calling start() again will\nincrease the reference count of the clock again. However stop() is\nonly called once, the reference count is unbalance.\n2. If the watchdog is stopped, calling settimeout() will start\nthe hardware timer accidentally.\nFactor out the register-writing logic into a helper function. Only call\nit in settimeout() if the watchdog is running. Otherwise, simply update\n`wdev->timeout`.", "A flaw was found in the Linux kernel's Mstar MSC313e watchdog driver. When adjusting the watchdog timeout setting, the driver unconditionally activates the timer even if the watchdog device is currently inactive. A local user with access to configure the watchdog device could exploit this flaw to cause an unexpected system reboot leading to a Denial of Service (DoS), or cause an unreleased clock resource leak."], "name": "CVE-2026-97969", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97969\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97969\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97969.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9800b7994642a794afd4894f072541c14277ce8,2152a13ee2a9af09a668ebd053a8dbf771dadb80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9800b7994642a794afd4894f072541c14277ce8,2abf99a57b0b71b2b97745981f4039370ab78044)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9800b7994642a794afd4894f072541c14277ce8,faf1eb2895c87a8c0fb920439dddc7e0d97c6a69)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9800b7994642a794afd4894f072541c14277ce8,3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T14:45:18.438337+00:00", "updated": "2026-10-01T09:15:06.320739+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}