Executive brief
The ASUS WMI driver in the Linux kernel failed to properly clean up system resources (input devices, sysfs groups, backlight, rfkill) when certain subsystems failed to initialize during driver startup. This could leave memory and system objects allocated but unreferenced, gradually consuming system resources and potentially degrading system stability over repeated driver initialization attempts.
Technical details
The vulnerability is a resource leak caused by misalignment of error-handling labels in the asus_wmi_add() probe function. When asus_wmi_custom_fan_curve_init() or asus_screenpad_init() failed, the goto labels were ordered incorrectly, causing the error path to skip preceding cleanup calls (input device, sysfs, backlight, and rfkill teardown). The fix reorders the fail_* labels to match the reverse sequence of resource allocations, ensuring all allocated resources are properly released on any initialization failure. This is a local denial-of-service vector only if the driver repeatedly fails and recovers, but the primary impact is resource exhaustion on affected systems with ASUS hardware.
Affected products
- Linux Linux kernel all versions with asus-wmi driver (approximately 5.0 and later based on commit history)
Timeline
- 2026-09-17: disclosed: CVE-2026-93116 published
- 2026-07-10: patched: Fix committed upstream (commit ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95)
- 2026-09-14: patched: Fix included in stable tree