CVE-2026-98535

Received Received - Intake

Clock Reference Leak in Linux Kernel fsl/fman

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either. Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98535

EUVD

EUVD-2026-103580

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	414fd46e77626f4e1f89ab4be6b876ef91e89dfa
Linux	Linux	4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a clock reference leak in the fsl/fman driver. The function read_dts_node() calls of_clk_get() which increments the clock's reference count, but the clock is never released using clk_put(). This leads to a resource leak where the clock reference remains held indefinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's fsl/fman driver and involves a clock reference leak. Detection requires checking kernel logs for fman-related errors or examining the driver's source code for improper clock handling. No direct network detection commands are applicable.

Impact Analysis

The impact is primarily on system stability and resource management. A leaked clock reference can cause the system to run out of available clock resources over time, potentially leading to clock-related failures or degraded performance.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it involves a clock reference leak in the Linux kernel's fsl/fman driver. It is a resource management issue without implications for data protection or privacy regulations.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. Monitor kernel logs for fman-related errors after updating. If custom kernel modifications exist, review the fsl/fman driver for proper clock reference management.

Hi! I’m here to help you understand CVE-2026-98535. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70