platform/x86: asus-wmi: fix resource leaks on probe failure
CVE-2026-93116 · published 17 Sept 2026
How serious is it
- Severity: high, CVSS score 7 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-93116?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to < 959ed35f8c8f07b8dd43c3f917a43ae2f77e4471, 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to < 8d5999608da60db45949e5459f74f581cdaacd04, 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to < 8410cd2690d463b60527d00ac8cffea2d5a041f6, 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to < 3308b8c5f5a28403611a2f5a46f06aabe4f0c661
- Linux Linux: 5.17
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wmi: fix resource leaks on probe failure
During driver initialization in asus_wmi_add(), various subsystems are
registered sequentially. However, the error path labels are out of order
relative to the registration sequence.
Specifically:
1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to
fail_custom_fan_curve. Because this label is placed below fail_sysfs,
it bypasses the cleanup calls for the input device and sysfs groups,
which were successfully registered before, leaking those resources.
2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad.
Because fail_screenpad is placed below fail_backlight, it bypasses the
cleanup calls for backlight and rfkill, leaking those resources.
Fix these resource leaks by reordering the error path labels in
asus_wmi_add() to match the exact reverse order of the resource
allocations.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/959ed35f8c8f07b8dd43c3f917a43ae2f77e4471
- git.kernel.org/stable/c/8d5999608da60db45949e5459f74f581cdaacd04
- git.kernel.org/stable/c/8410cd2690d463b60527d00ac8cffea2d5a041f6
- git.kernel.org/stable/c/3308b8c5f5a28403611a2f5a46f06aabe4f0c661
- git.kernel.org/stable/c/ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON