CVE Tools
Track your stack

CVE-2026-98208

mmc: sdio_uart: fix xmit_fifo leak when the port table is full

No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.

CVSS —Not scoredEPSS percentile7th0.2% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ 8b197a5ce7a7218bb9fc721647ba0d5734f27348, < 9e992d59138fcfaa4bad7cc0750265b0a8bca100Upgrade to: 9e992d59138fcfaa4bad7cc0750265b0a8bca100Affected: ≥ 8b197a5ce7a7218bb9fc721647ba0d5734f27348, < b97b5b66c93cb4aaf6358727a73fff880a774dfdUpgrade to: b97b5b66c93cb4aaf6358727a73fff880a774dfdAffected: ≥ 8b197a5ce7a7218bb9fc721647ba0d5734f27348, < 8a2c1bf209ba04cbd14153a771724bd5aa522fcdUpgrade to: 8a2c1bf209ba04cbd14153a771724bd5aa522fcdAffected: ≥ 8b197a5ce7a7218bb9fc721647ba0d5734f27348, < 72f4c2b7a48423c708f2c348585419a1b71ab04cUpgrade to: 72f4c2b7a48423c708f2c348585419a1b71ab04c + 4 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio_uart: fix xmit_fifo leak when the port table is full sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, it returns -EBUSY with the fifo still allocated, but the probe error path only kfree()s the port, leaking the transmit fifo. Free the fifo in the failure path of sdio_uart_add_port() itself so the function retains nothing on error.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS7th
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

2 events over 0 days, from the signal feeds we watch.

  1. Publishedrecord updated

Affected products

Sources

References in the record

And 5 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.