OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-93116

HIGH · CVSS 7 EPSS 0.15%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's asus-wmi driver, where improper error handling during driver initialization can lead to resource leaks if certain initialization steps fail. Specifically, the error handling paths do not align with the order of resource allocation, resulting in unfreed resources for input devices, sysfs groups, backlight, and rfkill. Linux system administrators and developers using affected versions of the kernel should prioritize this fix to prevent potential resource exhaustion and instability in systems utilizing ASUS hardware.

CVE
CVE-2026-93116
Severity
HIGH
CVSS
7
EPSS
0.15%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence. Specifically: 1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to fail_custom_fan_curve. Because this label is placed below fail_sysfs, it bypasses the cleanup calls for the input device and sysfs groups, which were successfully registered before, leaking those resources. 2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad. Because fail_screenpad is placed below fail_backlight, it bypasses the cleanup calls for backlight and rfkill, leaking those resources. Fix these resource leaks by reordering the error path labels in asus_wmi_add() to match the exact reverse order of the resource allocations.