CVE-2026-98093

high

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_micfil: balance mclk enable/disable hw_params() enables mclk unconditionally an…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_micfil: balance mclk enable/disable hw_params() enables mclk unconditionally and hw_free() disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hw_free() can run without hw_params(), and hw_params() can be called multiple times from the SETUP state. This triggers an "already disabled" WARN() in the first case and leaks an enable reference in the second, leaving the clock ungateable. Guard both sides with the existing mclk_flag, as fsl_sai.c does with mclk_streams.

CVSS

7.8

7.8 (CVSS v3.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-09-25 11:17

Modified: 2026-10-23 18:48

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:55 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥6.13 <6.18.53, ≥6.19 <7.2.7, 7.3

Weakness classification (CWE)

CWE-404

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/470db2026a435b79f7ecb4d65523ea16a99d55d8

Patch / mitigation: https://git.kernel.org/stable/c/d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56

Patch / mitigation: https://git.kernel.org/stable/c/fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5

References

https://git.kernel.org/stable/c/470db2026a435b79f7ecb4d65523ea16a99d55d8 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d3dbccfe6afa7b9a6a7ed65cfaa76a47fa050a56 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fa1bbe3534499dd89d3b0b941d6dd4ddb70c31b5 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-98093

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs