{
  "cveId": "CVE-2026-98826",
  "url": "https://patchblox.com/security/cve/CVE-2026-98826",
  "summary": "CVE-2026-98826 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-98826, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "rtc: ac100: Fix clock provider use-after-free on probe failure",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  rtc: ac100: Fix clock provider use-after-free on probe failure  ac100_rtc_register_clks() registers the RTC-32k clock with clk_hw_register_fixed_rate() and the clock provider with of_clk_add_hw_provider(). Neither is device managed, and both are released only from ac100_rtc_remove(). The driver core does not call remove() when probe() fails: really_probe() reaches probe_failed below the device_remove() call and goes straight to releasing the device\u0027s managed resources.  ac100_rtc_probe() ends with  \treturn devm_rtc_register_device(chip-\u003Ertc);  so if that fails after the clocks have been registered, the provider is left on the global of_clk_providers list holding chip-\u003Eclk_data, which was allocated with devm_kzalloc() and is freed while probe() unwinds. A later lookup on this device tree node then reads freed memory in of_clk_hw_onecell_get(). Consumers that do exactly that exist in tree: the wifi power sequence nodes on sun8i-a83t-bananapi-m3 and sun8i-a83t-cubietruck-plus take \u003C\u0026ac100_rtc 1\u003E, and the sun9i-a80 boards route osc32k through \u003C\u0026ac100_rtc 0\u003E. The window is narrow, as devm_rtc_register_device() can only fail with -ENOMEM here, but the provider is left dangling whenever it does.  The RTC-32k clock is leaked on the same path. Since clk_core_lookup() searches a global list that is not scoped per device, __clk_register() rejects the duplicate name with -EEXIST, so the leak also makes a later probe of the same device fail.  The error path that returns -EINVAL when the ADDA 4M parent clock cannot be found leaks the RTC-32k clock in the same way. No provider has been registered at that point, so that one is a leak rather than a use-after-free.  Register both with devm_clk_hw_register_fixed_rate() and devm_of_clk_add_hw_provider() so that they are released whenever the device goes away, on a failed probe as well as on unbind. Devres releases in reverse order of acquisition, so the provider is removed before chip-\u003Eclk_data is freed, and the clkout children are now unregistered before their parent rather than after it. ac100_rtc_unregister_clks() and the remove callback then have nothing left to do and are removed.",
  "published": "2026-10-18T16:17:36Z",
  "severity": "Moderate",
  "cvss": 6.4,
  "epss": 0.002,
  "epssPercentile": 0.09884,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98826",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-98826",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98826",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98826",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98826",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.113-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-98826",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98826",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}