{"id":"CVE-2026-98535","kind":"vulnerability","aliases":["CVE-2026-98535"],"related":[],"title":"Linux kernel: Freescale FMan clock reference leak in device tree reading","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfsl/fman: Fix clk reference leak in read_dts_node()\n\nof_clk_get() returns a clock with its reference count incremented, but\nread_dts_node() only uses it to read the rate and never calls clk_put().\nThe clock is not stored anywhere, so the reference cannot be released\nlater either.\n\nRelease the clock once its rate has been read, which also covers the\nerror path taken when the rate is zero.","summary":"The Freescale FMan driver in the Linux kernel gets a clock from the device tree and reads its rate but never releases the reference, so the clock reference count leaks. The sources describe a resource leak and do not mention a way for an attacker to gain access or run code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","freescale-fman","infrastructure","linux-kernel"],"not_affected_if":["no-fsl-fman-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix (the version is not stated in the sources).","status":"open","published_at":"2026-10-18T16:17:05+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:48+00:00","updated_at":"2026-10-25T05:23:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:23:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix (the version is not stated in the sources).","reach":"unknown","title":"Linux kernel: Freescale FMan clock reference leak in device tree reading","impact":"low","summary":"The Freescale FMan driver in the Linux kernel gets a clock from the device tree and reads its rate but never releases the reference, so the clock reference count leaks. The sources describe a resource leak and do not mention a way for an attacker to gain access or run code.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","freescale-fman","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; a clock reference leak at most exhausts a kernel resource","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-fsl-fman-hardware"],"who_is_affected":"Systems running a Linux kernel with the Freescale FMan (fsl/fman) network driver, typically Freescale/NXP QorIQ based boards, where the device tree defines FMan nodes. Systems without this hardware are not affected. The sources do not say whether the leak can be triggered by an attacker.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000569,"input_tokens":3366,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98535':14A,17A 'access':73B 'also':147C 'anywher':128C 'attack':70B 'call':120C 'cannot':132C 'clk':89C,97C,121C 'clock':5A,36B,52B,101C,124C,139C 'code':76B 'count':54B,105C 'cover':148C 'cve':12A,15A 'describ':58B 'devic':9A,39B 'driver':29B 'dts':94C,109C 'either':136C 'embed':18B 'error':150C 'fix':88C 'fman':4A,21B,28B 'follow':82C 'freescal':3A,20B,27B 'freescale-fman':19B 'fsl/fman':87C 'gain':72B 'get':34B,98C 'increment':106C 'infrastructur':22B 'kernel':2A,25B,33B,80C 'later':135C 'leak':7A,55B,61B,91C 'linux':1A,24B,32B,79C 'linux-kernel':23B 'mention':65B 'never':46B,119C 'node':95C,110C 'path':151C 'put':122C 'rate':44B,117C,142C,155C 'read':11A,42B,93C,108C,115C,145C 'refer':6A,49B,53B,90C,104C,131C 'releas':47B,134C,137C 'resolv':86C 'resourc':60B 'return':99C 'run':75B 'sourc':57B 'store':127C 'taken':152C 'tree':10A,40B 'use':112C 'vulner':83C 'way':67B 'zero':157C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Freescale FMan (fsl/fman) network driver, typically Freescale/NXP QorIQ based boards, where the device tree defines FMan nodes. Systems without this hardware are not affected. The sources do not say whether the leak can be triggered by an attacker.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98535","severity":null,"published_at":"2026-10-18T16:17:05+00:00","modified_at":"2026-10-19T10:19:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}