CVE-2026-98208

What the bug is

sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo. Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/mmc/core/sdio_uart.c

What this is

MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND SDIO SUBSYSTEMMAINTAINERS section matched on drivers/mmc/ · linux-mmc@vger.kernel.org · Maintained

Kernel module

sdio_uart

Check it on the machine

grep -wE 'CONFIG_MMC|CONFIG_SDIO_UART' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w sdio_uart

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
• trixieMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
• forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, loong64/loong64, s390x/s390x

M

a module where it is built at all; some flavours do not build it

Build switches

CONFIG_MMC, CONFIG_SDIO_UART

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-10-06 (13 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.18%, higher than 7.5% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/mmc

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.34	5.10.271	9e992d59138f
2.6.34	5.15.222	b97b5b66c93c
2.6.34	6.1.189	8a2c1bf209ba
2.6.34	6.6.158	72f4c2b7a484
2.6.34	6.12.112	fd8223c53ad9
2.6.34	6.18.54	ac866db277a4
2.6.34	7.2.8	5e142adbbdc5
2.6.34	7.3	53823e25793a

Debian advisories