{"cve":"CVE-2026-97969","nvd":{"published":"2026-09-25T11:17:24.767","modified":"2026-10-19T10:17:48.263","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n\nmsc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start() which\nintroduces two severe bugs:\n\n1. If the watchdog is already active, calling start() again will\n   increase the reference count of the clock again.  However stop() is\n   only called once, the reference count is unbalance.\n2. If the watchdog is stopped, calling settimeout() will start\n   the hardware timer accidentally.\n\nFactor out the register-writing logic into a helper function.  Only call\nit in settimeout() if the watchdog is running.  Otherwise, simply update\n`wdev->timeout`.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/2152a13ee2a9af09a668ebd053a8dbf771dadb80","https://git.kernel.org/stable/c/2abf99a57b0b71b2b97745981f4039370ab78044","https://git.kernel.org/stable/c/3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0","https://git.kernel.org/stable/c/68665016c7b777b44e27b6b0c1e6524c28ebe40a","https://git.kernel.org/stable/c/77ef2aa8b46876ca9935f32dd874c517ccf5d880"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-97969","score":0.00172,"percentile":0.0659,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}