CVE-2026-98825

Received Received - Intake

Null pointer dereference in Linux kernel RTC driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() devm_clk_get(&pdev->dev, "rtcref")'s return value was passed straight into clk_get_rate() without checking it for an error first, unlike the "rtc" clock a few lines above which is correctly checked with IS_ERR(). clk_get_rate() only guards against a NULL clk, not an error pointer: if (!clk) return 0; ... rate = clk_core_get_rate_recalc(clk->core); so if devm_clk_get() ever returns an error pointer here (for example ERR_PTR(-EPROBE_DEFER), which is the normal, expected outcome if the clkcfg clock-provider this RTC depends on has not registered its clocks yet by the time this driver probes), clk_get_rate() dereferences that error pointer instead of returning 0, crashing instead of letting probe defer. Capture the clock in the existing 'clk' local and check it with IS_ERR() before calling clk_get_rate(), matching the handling already used for the "rtc" clock in this same function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98825

EUVD

EUVD-2026-103765

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0b31d703598dc1993867597bbd45e87d824fc427
Linux	Linux	0b31d703598dc1993867597bbd45e87d824fc427
Linux	Linux	0b31d703598dc1993867597bbd45e87d824fc427
Linux	Linux	0b31d703598dc1993867597bbd45e87d824fc427
Linux	Linux	6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's RTC (Real-Time Clock) driver for the PolarFire SoC. The issue occurs in the probe function where a clock reference is obtained but not properly checked for errors before use. Specifically, devm_clk_get() can return an error pointer (like ERR_PTR(-EPROBE_DEFER)) if the required clock provider hasn't registered yet. This error pointer is then passed to clk_get_rate(), which dereferences it, causing a crash instead of allowing the probe to defer.

Detection Guidance

This vulnerability is specific to the Linux kernel's RTC (Real-Time Clock) driver for Microchip PolarFire SoC. Detection requires checking if the affected driver (rtc-mpfs) is loaded and if the system uses the vulnerable clock handling logic. Inspect kernel logs for errors related to clock probing or RTC initialization. Commands: dmesg | grep -i rtc, dmesg | grep -i clk, lsmod | grep rtc_mpfs.

Impact Analysis

This vulnerability could cause system crashes during boot or driver initialization if the RTC driver probes before its required clock provider is ready. It may lead to kernel panics or unexpected reboots, disrupting system stability. Users might experience failures in timekeeping functions or system initialization delays.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue causing a crash during probe due to improper error handling in clock retrieval. No data exposure or privacy impact is described.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98825. If immediate update is not possible, avoid using the affected RTC driver (rtc-mpfs) by blacklisting it or disabling the PolarFire SoC RTC functionality until the patch is applied.

Hi! I’m here to help you understand CVE-2026-98825. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70