---
id: "CVE-2026-98535"
kind: "vulnerability"
aliases: ["CVE-2026-98535"]
title: "Linux kernel: Freescale FMan clock reference leak in device tree reading"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "freescale-fman", "infrastructure", "linux-kernel"]
not_affected_if: ["no-fsl-fman-hardware"]
published_at: "2026-10-18T16:17:05+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98535", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: Freescale FMan clock reference leak in device tree reading

The Freescale FMan driver in the Linux kernel gets a clock from the device tree and reads its rate but never releases the reference, so the clock reference count leaks. The sources describe a resource leak and do not mention a way for an attacker to gain access or run code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream fix (the version is not stated in the sources).

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98535

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

fsl/fman: Fix clk reference leak in read_dts_node()

of_clk_get() returns a clock with its reference count incremented, but
read_dts_node() only uses it to read the rate and never calls clk_put().
The clock is not stored anywhere, so the reference cannot be released
later either.

Release the clock once its rate has been read, which also covers the
error path taken when the rate is zero.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_