CVE-2026-98826

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98826", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.372Z", "datePublished": "2026-10-18T15:49:19.709Z", "dateUpdated": "2026-10-19T09:26:19.030Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:19.030Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Fix clock provider use-after-free on probe failure\n\nac100_rtc_register_clks() registers the RTC-32k clock with\nclk_hw_register_fixed_rate() and the clock provider with\nof_clk_add_hw_provider(). Neither is device managed, and both are\nreleased only from ac100_rtc_remove(). The driver core does not call\nremove() when probe() fails: really_probe() reaches probe_failed below\nthe device_remove() call and goes straight to releasing the device's\nmanaged resources.\n\nac100_rtc_probe() ends with\n\n\treturn devm_rtc_register_device(chip->rtc);\n\nso if that fails after the clocks have been registered, the provider is\nleft on the global of_clk_providers list holding chip->clk_data, which\nwas allocated with devm_kzalloc() and is freed while probe() unwinds. A\nlater lookup on this device tree node then reads freed memory in\nof_clk_hw_onecell_get(). Consumers that do exactly that exist in tree:\nthe wifi power sequence nodes on sun8i-a83t-bananapi-m3 and\nsun8i-a83t-cubietruck-plus take <&ac100_rtc 1>, and the sun9i-a80 boards\nroute osc32k through <&ac100_rtc 0>. The window is narrow, as\ndevm_rtc_register_device() can only fail with -ENOMEM here, but the\nprovider is left dangling whenever it does.\n\nThe RTC-32k clock is leaked on the same path. Since clk_core_lookup()\nsearches a global list that is not scoped per device, __clk_register()\nrejects the duplicate name with -EEXIST, so the leak also makes a later\nprobe of the same device fail.\n\nThe error path that returns -EINVAL when the ADDA 4M parent clock cannot\nbe found leaks the RTC-32k clock in the same way. No provider has been\nregistered at that point, so that one is a leak rather than a\nuse-after-free.\n\nRegister both with devm_clk_hw_register_fixed_rate() and\ndevm_of_clk_add_hw_provider() so that they are released whenever the\ndevice goes away, on a failed probe as well as on unbind. Devres\nreleases in reverse order of acquisition, so the provider is removed\nbefore chip->clk_data is freed, and the clkout children are now\nunregistered before their parent rather than after it.\nac100_rtc_unregister_clks() and the remove callback then have nothing\nleft to do and are removed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/rtc/rtc-ac100.c"], "versions": [{"version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "lessThan": "12bcd20d76703ee2baf52224d287b7fea096b12f", "status": "affected", "versionType": "git"}, {"version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "lessThan": "9cff19ddd7f90c1f572a0f83cfc41de8f8dcbcd8", "status": "affected", "versionType": "git"}, {"version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "lessThan": "55ca60ba336632349f7c4585d22ba74ae355b7ce", "status": "affected", "versionType": "git"}, {"version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "lessThan": "fcf0b58e976e83adf246b014518e49c662b96f5e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/rtc/rtc-ac100.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/12bcd20d76703ee2baf52224d287b7fea096b12f"}, {"url": "https://git.kernel.org/stable/c/9cff19ddd7f90c1f572a0f83cfc41de8f8dcbcd8"}, {"url": "https://git.kernel.org/stable/c/55ca60ba336632349f7c4585d22ba74ae355b7ce"}, {"url": "https://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"}], "title": "rtc: ac100: Fix clock provider use-after-free on probe failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/rtc/rtc-ac100.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "12bcd20d76703ee2baf52224d287b7fea096b12f", "status": "affected", "version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "versionType": "git"}, {"lessThan": "9cff19ddd7f90c1f572a0f83cfc41de8f8dcbcd8", "status": "affected", "version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "versionType": "git"}, {"lessThan": "55ca60ba336632349f7c4585d22ba74ae355b7ce", "status": "affected", "version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "versionType": "git"}, {"lessThan": "fcf0b58e976e83adf246b014518e49c662b96f5e", "status": "affected", "version": "d00a18a42c1483924de086ddfb0efe8da1dba3ac", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/rtc/rtc-ac100.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Fix clock provider use-after-free on probe failure\n\nac100_rtc_register_clks() registers the RTC-32k clock with\nclk_hw_register_fixed_rate() and the clock provider with\nof_clk_add_hw_provider(). Neither is device managed, and both are\nreleased only from ac100_rtc_remove(). The driver core does not call\nremove() when probe() fails: really_probe() reaches probe_failed below\nthe device_remove() call and goes straight to releasing the device's\nmanaged resources.\n\nac100_rtc_probe() ends with\n\n\treturn devm_rtc_register_device(chip->rtc);\n\nso if that fails after the clocks have been registered, the provider is\nleft on the global of_clk_providers list holding chip->clk_data, which\nwas allocated with devm_kzalloc() and is freed while probe() unwinds. A\nlater lookup on this device tree node then reads freed memory in\nof_clk_hw_onecell_get(). Consumers that do exactly that exist in tree:\nthe wifi power sequence nodes on sun8i-a83t-bananapi-m3 and\nsun8i-a83t-cubietruck-plus take <&ac100_rtc 1>, and the sun9i-a80 boards\nroute osc32k through <&ac100_rtc 0>. The window is narrow, as\ndevm_rtc_register_device() can only fail with -ENOMEM here, but the\nprovider is left dangling whenever it does.\n\nThe RTC-32k clock is leaked on the same path. Since clk_core_lookup()\nsearches a global list that is not scoped per device, __clk_register()\nrejects the duplicate name with -EEXIST, so the leak also makes a later\nprobe of the same device fail.\n\nThe error path that returns -EINVAL when the ADDA 4M parent clock cannot\nbe found leaks the RTC-32k clock in the same way. No provider has been\nregistered at that point, so that one is a leak rather than a\nuse-after-free.\n\nRegister both with devm_clk_hw_register_fixed_rate() and\ndevm_of_clk_add_hw_provider() so that they are released whenever the\ndevice goes away, on a failed probe as well as on unbind. Devres\nreleases in reverse order of acquisition, so the provider is removed\nbefore chip->clk_data is freed, and the clkout children are now\nunregistered before their parent rather than after it.\nac100_rtc_unregister_clks() and the remove callback then have nothing\nleft to do and are removed."}], "id": "CVE-2026-98826", "lastModified": "2026-10-19T10:19:46.643", "metrics": {}, "published": "2026-10-18T16:17:36.823", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12bcd20d76703ee2baf52224d287b7fea096b12f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/55ca60ba336632349f7c4585d22ba74ae355b7ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9cff19ddd7f90c1f572a0f83cfc41de8f8dcbcd8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of service via use-after-free in the AC100 RTC driver", "id": "2555253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555253"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrtc: ac100: Fix clock provider use-after-free on probe failure\nac100_rtc_register_clks() registers the RTC-32k clock with\nclk_hw_register_fixed_rate() and the clock provider with\nof_clk_add_hw_provider(). Neither is device managed, and both are\nreleased only from ac100_rtc_remove(). The driver core does not call\nremove() when probe() fails: really_probe() reaches probe_failed below\nthe device_remove() call and goes straight to releasing the device's\nmanaged resources.\nac100_rtc_probe() ends with\nreturn devm_rtc_register_device(chip->rtc);\nso if that fails after the clocks have been registered, the provider is\nleft on the global of_clk_providers list holding chip->clk_data, which\nwas allocated with devm_kzalloc() and is freed while probe() unwinds. A\nlater lookup on this device tree node then reads freed memory in\nof_clk_hw_onecell_get(). Consumers that do exactly that exist in tree:\nthe wifi power sequence nodes on sun8i-a83t-bananapi-m3 and\nsun8i-a83t-cubietruck-plus take <&ac100_rtc 1>, and the sun9i-a80 boards\nroute osc32k through <&ac100_rtc 0>. The window is narrow, as\ndevm_rtc_register_device() can only fail with -ENOMEM here, but the\nprovider is left dangling whenever it does.\nThe RTC-32k clock is leaked on the same path. Since clk_core_lookup()\nsearches a global list that is not scoped per device, __clk_register()\nrejects the duplicate name with -EEXIST, so the leak also makes a later\nprobe of the same device fail.\nThe error path that returns -EINVAL when the ADDA 4M parent clock cannot\nbe found leaks the RTC-32k clock in the same way. No provider has been\nregistered at that point, so that one is a leak rather than a\nuse-after-free.\nRegister both with devm_clk_hw_register_fixed_rate() and\ndevm_of_clk_add_hw_provider() so that they are released whenever the\ndevice goes away, on a failed probe as well as on unbind. Devres\nreleases in reverse order of acquisition, so the provider is removed\nbefore chip->clk_data is freed, and the clkout children are now\nunregistered before their parent rather than after it.\nac100_rtc_unregister_clks() and the remove callback then have nothing\nleft to do and are removed.", "A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. If device initialization fails during driver probing, unmanaged clock provider references remain registered in global system lists while their underlying memory is released. Subsequent lookups referencing the affected device can access this freed memory, triggering a use-after-free condition that can lead to a system crash and Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98826", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:49:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98826\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98826\nhttps://git.kernel.org/stable/c/12bcd20d76703ee2baf52224d287b7fea096b12f\nhttps://git.kernel.org/stable/c/55ca60ba336632349f7c4585d22ba74ae355b7ce\nhttps://git.kernel.org/stable/c/9cff19ddd7f90c1f572a0f83cfc41de8f8dcbcd8\nhttps://git.kernel.org/stable/c/fcf0b58e976e83adf246b014518e49c662b96f5e"], "statement": "The AC100 RTC probe failure path can leave an OF clock provider registered after its device managed chip clk_data object has been freed. A later clock lookup for the same device tree node passes the dangling object to of_clk_hw_onecell_get, which reads freed num and hws fields and can return a stale clk_hw pointer to a consumer. The demonstrated primitive is a use-after-free read with a likely kernel crash or device initialization failure. A more serious consequence cannot be excluded because the freed object contains pointers that may be used by the clock subsystem after memory reuse. For the CVSS the PR:L value is used for the paranoid score because a local user may contribute to the required memory pressure without controlling the device directly, although reliable triggering normally requires an ENOMEM failure during probe and a later clock lookup. AC:H reflects this narrow timing and state requirement. The issue is not network reachable and affects systems with the AC100 RTC and a matching device tree clock consumer. Impact is at least local denial of service and the stale pointer path may allow confidentiality or integrity impact if the freed allocation is reused in a controllable way.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d00a18a42c1483924de086ddfb0efe8da1dba3ac,12bcd20d76703ee2baf52224d287b7fea096b12f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d00a18a42c1483924de086ddfb0efe8da1dba3ac,9cff19ddd7f90c1f572a0f83cfc41de8f8dcbcd8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d00a18a42c1483924de086ddfb0efe8da1dba3ac,55ca60ba336632349f7c4585d22ba74ae355b7ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d00a18a42c1483924de086ddfb0efe8da1dba3ac,fcf0b58e976e83adf246b014518e49c662b96f5e)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:30:17.102037+00:00", "updated": "2026-10-20T19:00:16.615951+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}