CVE-2026-97504 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
Review by sashiko.dev highlighted potential use after free and resource leak instances.
Set se10_pdev to null to prevent use after free
Remove DMI call back and instead directly call se10_create_platform_device. Handle error cases appropriately
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel watchdog subsystem contains a critical flaw within the lenovo_se10_wdt driver that exposes systems to potential denial of service conditions through memory corruption and resource exhaustion. This vulnerability arises from improper handling of device lifecycle events, specifically during the initialization and removal phases of the platform device associated with the Lenovo SE10 hardware monitoring component. The core issue involves a use-after-free condition where pointers referencing previously deallocated memory structures are accessed after their underlying resources have been released by the kernel. Additionally, there is a resource leak risk stemming from incorrect management of Dynamic Management Interface callbacks and platform device creation routines, which can lead to unreleased memory allocations or dangling references that compromise system stability over time.
From a technical perspective, the flaw manifests when the driver fails to properly nullify pointers after freeing associated data structures. In C-based kernel development, failing to set a pointer to NULL immediately following a free operation allows subsequent code paths to inadvertently dereference stale addresses. This can result in unpredictable behavior, including kernel panics or silent memory corruption that may be exploited by local attackers with sufficient privileges to trigger the affected driver routines. The original implementation relied on DMI callback mechanisms for device initialization, which introduced complexity and potential race conditions if error handling was not exhaustive. By removing the DMI call back mechanism and directly invoking se10_create_platform_device, the code path becomes more linear and easier to audit, reducing the surface area for such errors.
The operational impact of this vulnerability is significant for systems relying on the Lenovo SE10 watchdog timer for hardware health monitoring or automated recovery procedures. A successful exploitation could lead to a system crash, effectively causing a denial of service against critical infrastructure services hosted on affected machines. Furthermore, resource leaks contribute to gradual memory degradation over extended uptime periods, potentially leading to out-of-memory conditions that affect other kernel subsystems and user-space applications. This aligns with CWE-416, Use After Free, which describes the risk associated with accessing freed memory, and CWE-772, Missing Release of Resource after Effective Lifetime, regarding the resource leak aspect. The improper initialization sequence also touches upon CWE-823, Object Reference Used before Assignment, if pointers are accessed prior to proper allocation in certain error paths.
Mitigation strategies primarily involve applying the kernel patch that addresses these specific code defects. Administrators should ensure their systems are updated with the latest stable Linux kernel version containing this fix. For environments where immediate patching is not feasible, monitoring system logs for watchdog-related errors or unexpected reboots can serve as an early warning indicator of exploitation attempts or resource exhaustion events. Security teams should also review driver initialization code in custom kernels to ensure that all pointers are explicitly set to NULL after deallocation and that error handling paths correctly release any allocated resources before returning failure codes. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, as the vulnerability can be leveraged to disrupt local system availability through memory corruption or resource exhaustion attacks targeting kernel-level drivers.