Live › vulnerability › CVE-2026-99161
Go to dashboardThe Linux kernel's VIA/WMT I2C driver acquired its clock with of_clk_get() and never released it on probe failure or module unload, leaking a clock reference. The fix switches to devm_clk_get() so the clock is released automatically; the sources describe a resource leak, not code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the VIA/WMT I2C driver (typically VIA or Wondermedia ARM SoC boards) are the ones with this code path. Systems without that hardware or driver are unlikely to load it. The sources do not say which kernel versions are affected.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clk_put(), leading to a resource leak.
Switch to devm_clk_get() so that the clock is automatically managed and released.
This page as .md · .json · in your agent: get_signal("CVE-2026-99161")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.