{"id":"CVE-2026-98826","kind":"vulnerability","aliases":["CVE-2026-98826"],"related":[],"title":"Linux kernel: RTC AC100 driver frees clock provider too early on probe failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Fix clock provider use-after-free on probe failure\n\nac100_rtc_register_clks() registers the RTC-32k clock with\nclk_hw_register_fixed_rate() and the clock provider with\nof_clk_add_hw_provider(). Neither is device managed, and both are\nreleased only from ac100_rtc_remove(). The driver core does not call\nremove() when probe() fails: really_probe() reaches probe_failed below\nthe device_remove() call and goes straight to releasing the device's\nmanaged resources.\n\nac100_rtc_probe() ends with\n\n\treturn devm_rtc_register_device(chip->rtc);\n\nso if that fails after the clocks have been registered, the provider is\nleft on the global of_clk_providers list holding chip->clk_data, which\nwas allocated with devm_kzalloc() and is freed while probe() unwinds. A\nlater lookup on this device tree node then reads freed memory in\nof_clk_hw_onecell_get(). Consumers that do exactly that exist in tree:\nthe wifi power sequence nodes on sun8i-a83t-bananapi-m3 and\nsun8i-a83t-cubietruck-plus take <&ac100_rtc 1>, and the sun9i-a80 boards\nroute osc32k through <&ac100_rtc 0>. The window is narrow, as\ndevm_rtc_register_device() can only fail with -ENOMEM here, but the\nprovider is left dangling whenever it does.\n\nThe RTC-32k clock is leaked on the same path. Since clk_core_lookup()\nsearches a global list that is not scoped per device, __clk_register()\nrejects the duplicate name with -EEXIST, so the leak also makes a later\nprobe of the same device fail.\n\nThe error path that returns -EINVAL when the ADDA 4M parent clock cannot\nbe found leaks the RTC-32k clock in the same way. No provider has been\nregistered at that point, so that one is a leak rather than a\nuse-after-free.\n\nRegister both with devm_clk_hw_register_fixed_rate() and\ndevm_of_clk_add_hw_provider() so that they are released whenever the\ndevice goes away, on a failed probe as well as on unbind. Devres\nreleases in reverse order of acquisition, so the provider is removed\nbefore chip->clk_data is freed, and the clkout children are now\nunregistered before their parent rather than after it.\nac100_rtc_unregister_clks() and the remove callback then have nothing\nleft to do and are removed.","summary":"When the ac100 RTC driver fails to probe after registering its clocks, the clock provider stays registered and points at memory that has already been freed. A later clock lookup for that device tree node can read freed memory, which can crash the kernel or be used for further memory corruption.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["allwinner","arm","linux-kernel","other","rtc-ac100"],"not_affected_if":["no-ac100-hardware","x86-or-other-non-allwinner-boards"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:36+00:00","updated_at":"2026-10-25T05:14:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:14:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: RTC AC100 driver frees clock provider too early on probe failure","impact":"low","summary":"When the ac100 RTC driver fails to probe after registering its clocks, the clock provider stays registered and points at memory that has already been freed. A later clock lookup for that device tree node can read freed memory, which can crash the kernel or be used for further memory corruption.","category":"other","nicknames":[],"who_cares":["linux-kernel","arm","allwinner","rtc-ac100"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel reads freed memory during a clock lookup, possible crash","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-ac100-hardware","x86-or-other-non-allwinner-boards"],"who_is_affected":"Only systems running a Linux kernel with the rtc-ac100 driver, which is used on Allwinner ARM boards such as sun8i-a83t and sun9i-a80 device trees. The sources do not state which kernel versions are fixed. The window is narrow: the bug only matters when the RTC device registration fails after the clocks were registered, which the sources say can only happen on an out-of-memory error.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000643,"input_tokens":4051,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98826':16A,19A '0':278C '1':266C '32k':110C,306C,368C '4m':358C 'a80':271C 'a83t':254C,260C 'ac100':4A,28B,31B,91C,102C,138C,171C,264C,276C,462C 'acquisit':436C 'add':125C,408C 'adda':357C 'alloc':210C 'allwinn':20B 'alreadi':52B 'also':339C 'arm':21B 'away':420C 'bananapi':255C 'board':272C 'call':146C,160C 'callback':469C 'cannot':361C 'children':451C 'chip':181C,205C,443C 'clk':113C,124C,201C,206C,234C,315C,328C,399C,407C,444C 'clkout':450C 'clks':105C,465C 'clock':7A,40B,42B,57B,93C,111C,120C,189C,307C,360C,369C 'consum':238C 'core':143C,316C 'corrupt':79B 'crash':70B 'cubietruck':261C 'cve':14A,17A 'dangl':299C 'data':207C,445C 'devic':61B,130C,158C,167C,180C,225C,287C,327C,347C,418C 'devm':177C,212C,284C,398C,405C 'devr':430C 'driver':5A,33B,142C 'duplic':332C 'earli':10A 'eexist':335C 'einval':354C 'end':174C 'enomem':292C 'error':350C 'exact':241C 'exist':243C 'fail':34B,150C,155C,186C,290C,348C,423C 'failur':13A,101C 'fix':92C,116C,402C 'follow':85C 'found':363C 'free':6A,98C,394C 'freed':54B,66B,216C,230C,447C 'get':237C 'global':199C,320C 'goe':162C,419C 'hold':204C 'hw':114C,126C,235C,400C,409C 'kernel':2A,24B,72B,83C 'kzalloc':213C 'later':56B,221C,342C 'leak':309C,338C,364C,387C 'left':196C,298C,473C 'linux':1A,23B,82C 'linux-kernel':22B 'list':203C,321C 'lookup':58B,222C,317C 'm3':256C 'make':340C 'manag':131C,169C 'memori':49B,67B,78B,231C 'name':333C 'narrow':282C 'neither':128C 'node':63B,227C,250C 'noth':472C 'one':384C 'onecel':236C 'order':434C 'osc32k':274C 'parent':359C,457C 'path':313C,351C 'per':326C 'plus':262C 'point':47B,381C 'power':248C 'probe':12A,36B,100C,149C,152C,154C,173C,218C,343C,424C 'provid':8A,43B,94C,121C,127C,194C,202C,296C,375C,410C,439C 'rate':117C,403C 'rather':388C,458C 'reach':153C 'read':65B,229C 'realli':151C 'regist':38B,45B,104C,106C,115C,179C,192C,286C,329C,378C,395C,401C 'reject':330C 'releas':135C,165C,415C,431C 'remov':140C,147C,159C,441C,468C,478C 'resolv':89C 'resourc':170C 'return':176C,353C 'revers':433C 'rout':273C 'rtc':3A,27B,32B,90C,103C,109C,139C,172C,178C,182C,265C,277C,285C,305C,367C,463C 'rtc-32k':108C,304C,366C 'rtc-ac100':26B 'scope':325C 'search':318C 'sequenc':249C 'sinc':314C 'stay':44B 'straight':163C 'sun8i':253C,259C 'sun8i-a83t-bananapi-m3':252C 'sun8i-a83t-cubietruck-plus':258C 'sun9i':270C 'sun9i-a80':269C 'take':263C 'tree':62B,226C,245C 'unbind':429C 'unregist':454C,464C 'unwind':219C 'use':75B,96C,392C 'use-after-fre':95C,391C 'vulner':86C 'way':373C 'well':426C 'whenev':300C,416C 'wifi':247C 'window':280C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the rtc-ac100 driver, which is used on Allwinner ARM boards such as sun8i-a83t and sun9i-a80 device trees. The sources do not state which kernel versions are fixed. The window is narrow: the bug only matters when the RTC device registration fails after the clocks were registered, which the sources say can only happen on an out-of-memory error.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98826","severity":null,"published_at":"2026-10-18T16:17:36+00:00","modified_at":"2026-10-19T10:19:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}