All vulnerabilities
CVE-2026-98825

Linux: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in74dc7c52946e3d47c40edd0875adb7cc15937066Also 8a03f8422fa08eed335c51bccb612a3d81739ff2CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 74dc7c52946e3d47c40edd0875adb7cc15937066LinuxCVE List
  • 8a03f8422fa08eed335c51bccb612a3d81739ff2LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()

devm_clk_get(&pdev->dev, "rtcref")'s return value was passed straight into clk_get_rate() without checking it for an error first, unlike the "rtc" clock a few lines above which is correctly checked with IS_ERR(). clk_get_rate() only guards against a NULL clk, not an error pointer:

if (!clk) return 0; ... rate = clk_core_get_rate_recalc(clk->core);

so if devm_clk_get() ever returns an error pointer here (for example ERR_PTR(-EPROBE_DEFER), which is the normal, expected outcome if the clkcfg clock-provider this RTC depends on has not registered its clocks yet by the time this driver probes), clk_get_rate() dereferences that error pointer instead of returning 0, crashing instead of letting probe defer.

Capture the clock in the existing 'clk' local and check it with IS_ERR() before calling clk_get_rate(), matching the handling already used for the "rtc" clock in this same function.

Text from CVE List

Affected versions 12

  • Linuxaffected: 0b31d703598dc1993867597bbd45e87d824fc427 before ab741d1b714b4acc605f3d14cdc4120f87341ed1CVE List
  • Linuxaffected: 0b31d703598dc1993867597bbd45e87d824fc427 before 74dc7c52946e3d47c40edd0875adb7cc15937066CVE List
  • Linuxaffected: 0b31d703598dc1993867597bbd45e87d824fc427 before cfd70c9b19846c524f2b6195a7484bdf22071ccfCVE List
  • Linuxaffected: 0b31d703598dc1993867597bbd45e87d824fc427 before 8a03f8422fa08eed335c51bccb612a3d81739ff2CVE List
  • Linuxaffected: 0b31d703598dc1993867597bbd45e87d824fc427 before ac41b05d15db3134e839148290d67415ee0bdb58CVE List
  • Linuxaffected: 6.0CVE List
  • Linuxunaffected: all versions before 6.0CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5