CVE-2026-90147clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() devm_clk_get_optional_enabled_with_rate() registers its cleanup action before setting the clock rate. If setting the rate fails, it attempts to disable and unprepare a clock that was never enabled. This issue was spotted while reviewing "rust: clk: add devres-managed clks" [1]. Register the cleanup action only after successfully preparing and enabling the clock. [1]: https://lore.kernel.org/rust-for-linux/20260706-clk-type-state-v5-3-67c5f326a16c@collabora.com
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 9934a1bd45b2b03f6d1204a6ae2780d3b009799f builds before 9a365f41fe0f227ef5a269e240233bd0bffc66c9; 9934a1bd45b2b03f6d1204a6ae2780d3b009799f builds before 9d4843f1051259854f724e9cdc5b9eac56327037; from 9934a1bd45b2b03f6d1204a6ae2780d3b009799f before 647157fecb42b72d930e7b7d0bfbc5f2db9a858a; 9934a1bd45b2b03f6d1204a6ae2780d3b009799f builds before 0d4d262c1664365e17e0a5ba2ab79f4db484b44e | CNA record |
References
- https://git.kernel.org/stable/c/9a365f41fe0f227ef5a269e240233bd0bffc66c9
- https://git.kernel.org/stable/c/9d4843f1051259854f724e9cdc5b9eac56327037
- https://git.kernel.org/stable/c/647157fecb42b72d930e7b7d0bfbc5f2db9a858a
- https://git.kernel.org/stable/c/0d4d262c1664365e17e0a5ba2ab79f4db484b44e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.