{"id":"CVE-2026-99161","kind":"vulnerability","aliases":["CVE-2026-99161"],"related":[],"title":"Linux kernel: VIA/WMT I2C driver leaks a clock reference on probe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()\n\nIn wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any\nsubsequent operation fails or when the module is unloaded, the clock\nreference count is never decremented via clk_put(), leading to a\nresource leak.\n\nSwitch to devm_clk_get() so that the clock is automatically managed\nand released.","summary":"The Linux kernel's VIA/WMT I2C driver acquired its clock with of_clk_get() and never released it on probe failure or module unload, leaking a clock reference. The fix switches to devm_clk_get() so the clock is released automatically; the sources describe a resource leak, not code execution or data exposure.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","i2c","infrastructure","linux-kernel"],"not_affected_if":["no-via-wmt-hardware"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes the upstream commit 'i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()'; the sources do not list fixed version numbers.","status":"open","published_at":"2026-10-28T11:17:36+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:46+00:00","updated_at":"2026-10-28T11:35:46+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-28T11:35:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()'; the sources do not list fixed version numbers.","reach":"local","title":"Linux kernel: VIA/WMT I2C driver leaks a clock reference on probe","impact":"low","summary":"The Linux kernel's VIA/WMT I2C driver acquired its clock with of_clk_get() and never released it on probe failure or module unload, leaking a clock reference. The fix switches to devm_clk_get() so the clock is released automatically; the sources describe a resource leak, not code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","i2c"],"confidence":0.8,"needs_auth":"no","worst_case":"A clock reference leaks on probe failure or module unload, causing resource leakage.","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-via-wmt-hardware"],"who_is_affected":"Systems running a Linux kernel with the VIA/WMT I2C driver (typically VIA or Wondermedia ARM SoC boards) are the ones with this code path. Systems without that hardware or driver are unlikely to load it. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000593,"input_tokens":3382,"output_tokens":510,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99161':14A,17A 'acquir':31B,105C 'automat':64B,146C 'clk':36B,57B,103C,108C,129C,139C 'clock':8A,33B,50B,61B,92C,122C,144C 'code':72B 'count':124C 'cve':12A,15A 'data':75B 'decrement':127C 'describ':67B 'devm':56B,138C 'driver':5A,30B 'embed':18B 'execut':73B 'exposur':76B 'fail':114C 'failur':44B 'fix':53B,91C 'follow':82C 'get':37B,58B,109C,140C 'i2c':4A,19B,29B,87C,96C,100C,102C 'infrastructur':20B 'kernel':2A,23B,26B,80C 'lead':131C 'leak':6A,48B,70B,93C,135C 'linux':1A,22B,25B,79C 'linux-kernel':21B 'manag':147C 'modul':46B,118C 'never':39B,126C 'oper':113C 'probe':11A,43B,97C,101C 'put':130C 'refer':9A,51B,123C 'releas':40B,63B,149C 'resolv':86C 'resourc':69B,134C 'sourc':66B 'subsequ':112C 'switch':54B,136C 'unload':47B,120C 'use':106C 'via':128C 'via/wmt':3A,28B 'viai2c':89C 'viai2c-wmt':88C 'vulner':83C 'wmt':90C,95C,99C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the VIA/WMT I2C driver (typically VIA or Wondermedia ARM SoC boards) are the ones with this code path. Systems without that hardware or driver are unlikely to load it. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99161","severity":null,"published_at":"2026-10-28T11:17:36+00:00","modified_at":"2026-10-28T11:17:36+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}