← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99161

28 October 2026

In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clk_put(), leading to a resource leak.

Switch to devm_clk_get() so that the clock is automatically managed and released.

Introduced

3.11 560746eb79d3124a278452c8dd968682b521cc82

Fixed releases

6.18.59 5d476bb76b7d72d8b7ed04a9c614900b097e3af7

7.2.13 1875de656370c89b99a150d220df876288ee0344

7.3 aaabefc79b0ff0018e8e3832169bbe359d0551fc

View source announcement ↗