CVE-2026-98826

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rtc: ac100: Fix clock provider use-after-free on probe failure

ac100_rtc_register_clks() registers the RTC-32k clock with

clk_hw_register_fixed_rate() and the clock provider with

of_clk_add_hw_provider(). Neither is device managed, and both are

released only from ac100_rtc_remove(). The driver core does not call

remove() when probe() fails: really_probe() reaches probe_failed below

the device_remove() call and goes straight to releasing the device's

managed resources.

ac100_rtc_probe() ends with

return devm_rtc_register_device(chip->rtc);

so if that fails after the clocks have been registered, the provider is

left on the global of_clk_providers list holding chip->clk_data, which

was allocated with devm_kzalloc() and is freed while probe() unwinds. A

later lookup on this device tree node then reads freed memory in

of_clk_hw_onecell_get(). Consumers that do exactly that exist in tree:

the wifi power sequence nodes

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References