{"id":"CVE-2026-98676","kind":"vulnerability","aliases":["CVE-2026-98676"],"related":[],"title":"Linux kernel: ADE9000 driver crashes on probe with external clock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ade9000: fix NULL pointer dereference in clkout registration\n\nade9000_setup_clkout() passes NULL as the register address when\nregistering a divider clock. During clock registration, the common\nclock framework calls clk_divider_recalc_rate(), which dereferences\nthe address through readl(). As a result, probing an ADE9000 configured\nas a clock provider with an external input clock crashes.\n\nCLKOUT passes CLKIN through without changing its rate. Register it as\na 1:1 fixed-factor clock, which does not require register access.\n\nThis change does not affect the configuration using the internal clock,\nfor which the driver does not register a clock provider.","summary":"A Linux kernel IIO driver for the ADE9000 energy-measurement chip passes a NULL register address when registering a clock divider, so probing the device as a clock provider with an external input clock dereferences NULL and crashes. The sources describe a kernel crash (denial of service) during driver probe, not code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ade9000","iio","infrastructure","linux-kernel"],"not_affected_if":["internal-clock","no-ade9000-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:20+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:17+00:00","updated_at":"2026-10-25T05:19:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:19:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: ADE9000 driver crashes on probe with external clock","impact":"low","summary":"A Linux kernel IIO driver for the ADE9000 energy-measurement chip passes a NULL register address when registering a clock divider, so probing the device as a clock provider with an external input clock dereferences NULL and crashes. The sources describe a kernel crash (denial of service) during driver probe, not code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","iio","ade9000"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel NULL dereference crashes the system during driver probe.","analyst_note":"Check the kernel.org stable commit for the fixed kernel versions and confirm which stable branches carry the fix; the sources give no version numbers.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["internal-clock","no-ade9000-hardware"],"who_is_affected":"Only systems running a Linux kernel with the ADE9000 IIO driver that configure the chip as a clock provider using an external input clock. The sources say the internal-clock configuration is not affected because the driver does not register a clock provider there. Teams not using the ADE9000 chip can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000589,"input_tokens":3456,"output_tokens":487,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98676':13A,16A '1':158C,159C 'access':169C 'adc':88C 'address':39B,105C,126C 'ade9000':3A,17B,30B,89C,97C,134C 'affect':174C 'call':118C 'chang':151C,171C 'chip':34B 'clk':119C 'clkin':148C 'clkout':95C,99C,146C 'clock':10A,43B,51B,57B,110C,112C,116C,138C,144C,163C,180C,189C 'code':75B 'common':115C 'configur':135C,176C 'crash':5A,61B,67B,145C 'cve':11A,14A 'denial':68B 'derefer':58B,93C,124C 'describ':64B 'devic':48B 'divid':44B,109C,120C 'driver':4A,27B,72B,184C 'energi':32B 'energy-measur':31B 'execut':76B 'extern':9A,55B,142C 'factor':162C 'fix':90C,161C 'fixed-factor':160C 'follow':82C 'framework':117C 'iio':18B,26B,87C 'infrastructur':19B 'input':56B,143C 'intern':179C 'kernel':2A,22B,25B,66B,80C 'linux':1A,21B,24B,79C 'linux-kernel':20B 'measur':33B 'null':37B,59B,91C,101C 'pass':35B,100C,147C 'pointer':92C 'probe':7A,46B,73B,132C 'provid':52B,139C,190C 'rate':122C,153C 'readl':128C 'recalc':121C 'regist':38B,41B,104C,107C,154C,168C,187C 'registr':96C,113C 'requir':167C 'resolv':86C 'result':131C 'servic':70B 'setup':98C 'sourc':63B 'use':177C 'vulner':83C 'without':150C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the ADE9000 IIO driver that configure the chip as a clock provider using an external input clock. The sources say the internal-clock configuration is not affected because the driver does not register a clock provider there. Teams not using the ADE9000 chip can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98676","severity":null,"published_at":"2026-10-18T16:17:20+00:00","modified_at":"2026-10-19T10:19:32+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}