GHSA-44QJ-HFJM-PR88

Vulnerability from github – Published: 2026-10-18 18:32 – Updated: 2026-10-30 15:34
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()

devm_clk_get(&pdev->dev, "rtcref")'s return value was passed straight into clk_get_rate() without checking it for an error first, unlike the "rtc" clock a few lines above which is correctly checked with IS_ERR(). clk_get_rate() only guards against a NULL clk, not an error pointer:

if (!clk)
    return 0;
...
rate = clk_core_get_rate_recalc(clk->core);

so if devm_clk_get() ever returns an error pointer here (for example ERR_PTR(-EPROBE_DEFER), which is the normal, expected outcome if the clkcfg clock-provider this RTC depends on has not registered its clocks yet by the time this driver probes), clk_get_rate() dereferences that error pointer instead of returning 0, crashing instead of letting probe defer.

Capture the clock in the existing 'clk' local and check it with IS_ERR() before calling clk_get_rate(), matching the handling already used for the "rtc" clock in this same function.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-98825"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-18T16:17:36Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()\n\ndevm_clk_get(\u0026pdev-\u003edev, \"rtcref\")\u0027s return value was passed straight\ninto clk_get_rate() without checking it for an error first, unlike the\n\"rtc\" clock a few lines above which is correctly checked with\nIS_ERR(). clk_get_rate() only guards against a NULL clk, not an error\npointer:\n\n\tif (!clk)\n\t\treturn 0;\n\t...\n\trate = clk_core_get_rate_recalc(clk-\u003ecore);\n\nso if devm_clk_get() ever returns an error pointer here (for example\nERR_PTR(-EPROBE_DEFER), which is the normal, expected outcome if the\nclkcfg clock-provider this RTC depends on has not registered its\nclocks yet by the time this driver probes), clk_get_rate() dereferences\nthat error pointer instead of returning 0, crashing instead of letting\nprobe defer.\n\nCapture the clock in the existing \u0027clk\u0027 local and check it with\nIS_ERR() before calling clk_get_rate(), matching the handling already\nused for the \"rtc\" clock in this same function.",
  "id": "GHSA-44qj-hfjm-pr88",
  "modified": "2026-10-30T15:34:04Z",
  "published": "2026-10-18T18:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98825"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/74dc7c52946e3d47c40edd0875adb7cc15937066"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7f59e824a4403e156cf930fe556b75139452099e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8a03f8422fa08eed335c51bccb612a3d81739ff2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab741d1b714b4acc605f3d14cdc4120f87341ed1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ac41b05d15db3134e839148290d67415ee0bdb58"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cfd70c9b19846c524f2b6195a7484bdf22071ccf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.