CVE-2026-93116

platform/x86: asus-wmi: fix resource leaks on probe failure

State: Published
Severity: 7.0 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: asus-wmi: fix resource leaks on probe failure

During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence.

Specifically: 1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to fail_custom_fan_curve. Because this label is placed below fail_sysfs, it bypasses the cleanup calls for the input device and sysfs groups, which were successfully registered before, leaking those resources. 2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad. Because fail_screenpad is placed below fail_backlight, it bypasses the cleanup calls for backlight and rfkill, leaking those resources.

Fix these resource leaks by reordering the error path labels in asus_wmi_add() to match the exact reverse order of the resource allocations.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 72d792c8053f238ae541fdaa90e609548509b65fAffected 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 959ed35f8c8f07b8dd43c3f917a43ae2f77e4471Affected 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 8d5999608da60db45949e5459f74f581cdaacd04Affected 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 8410cd2690d463b60527d00ac8cffea2d5a041f6Affected 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 3308b8c5f5a28403611a2f5a46f06aabe4f0c661Affected 0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 72d792c8053f238ae541fdaa90e609548509b65fAffected
0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 959ed35f8c8f07b8dd43c3f917a43ae2f77e4471Affected
0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 8d5999608da60db45949e5459f74f581cdaacd04Affected
0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 8410cd2690d463b60527d00ac8cffea2d5a041f6Affected
0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before 3308b8c5f5a28403611a2f5a46f06aabe4f0c661Affected
0f0ac158d28ff78e75c334e869b1cb8e69372a1f to before ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.