CVE-2026-98486
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a coherent DMA buffer for MMIO read responses. The normal removal path releases this buffer through ena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails after ena_device_init() succeeds, the error path destroys the admin resources and eventually frees ena_dev without destroying the MMIO read request, leaving the coherent DMA buffer allocated. Call ena_com_mmio_reg_read_request_destroy() in the probe error path before releasing the remaining device resources. This issue was found by manual code inspection.
Affected versions
Linux kernel versions
4.9
and later are affected. Fixed in
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98486?
CVE-2026-98486 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.9 onward and has been patched in 6.12.112, 6.18.55, 7.2.9 and others. CVE-2026-98486 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98486?
Yes. CVE-2026-98486 has been patched. Fixed versions include 6.12.112, 6.18.55, 7.2.9 and others. If you are running Linux kernel 4.9 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98486 actively exploited?
No. CVE-2026-98486 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.