CVE-2026-98667
Received Received - Intake

Uninitialized Clock Parent Data in Linux Kernel IIO Frequency Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. adf4377_clk_register() fills in init.parent_data, and assumes that init.parent_names is NULL. However, the latter is uninitialized, and thus may cause a crash. Similarly, adf4377_clk_register() fills in only parent_data.fw_name, leaving other members of the clk_parent_data structure uninitialized. Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98667
EUVD
EUVD-2026-103921

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 60e5448ddbec2dc206027a4850604d8fdf9973b7
Linux Linux 60e5448ddbec2dc206027a4850604d8fdf9973b7
Linux Linux 7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's IIO frequency driver for the ADF4377 clock generator. It involves incomplete initialization of the clk_init_data and clk_parent_data structures. When these structures are not fully zeroed, it can lead to crashes due to uninitialized memory being read. The issue is exposed when certain kernel stack initialization options are enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO frequency driver for ADF4377 devices. Detection requires checking the kernel version and whether the affected driver is loaded. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep adf4377' to see if the driver is loaded.

Impact Analysis

If you use a system with the affected Linux kernel driver for ADF4377, this bug could cause system crashes or instability. It may lead to unexpected reboots or kernel panics, disrupting services or causing data loss. Systems with specific kernel configurations enabling stack initialization checks are more likely to be affected.

Compliance Impact

This vulnerability is a low-level Linux kernel clock driver issue that could cause system crashes under specific kernel configuration settings. It does not directly impact data privacy, security controls, or compliance with standards like GDPR or HIPAA, as it is not related to data handling, access control, or audit mechanisms.

Mitigation Strategies

Apply the latest kernel patch that resolves this issue. Update your Linux distribution to a version with the patched kernel. If using a custom kernel, recompile with the fix for the adf4377 driver initialization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart