CVE-2026-98535fsl/fman: Fix clk reference leak in read_dts_node()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either. Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 414fd46e77626f4e1f89ab4be6b876ef91e89dfa before 874fd58b321a9238e47c2a46345444287f2a5781; from 414fd46e77626f4e1f89ab4be6b876ef91e89dfa before c2edf376d7804279878b207d93ffe6009c8d3d29; 414fd46e77626f4e1f89ab4be6b876ef91e89dfa builds before 5c90f99ba74b55ddd8e919224921033cc4077f01; from 414fd46e77626f4e1f89ab4be6b876ef91e89dfa before e560bdf62b11dcaa2a018345f76869d89ed43a9e; 414fd46e77626f4e1f89ab4be6b876ef91e89dfa builds before 9fd6d0861ae2fd44c771d6bc93b29bbc1202fe8e; from 414fd46e77626f4e1f89ab4be6b876ef91e89dfa before c2a5e591858629b6c0e284010d2ccdbc22fd0a43; from 414fd46e77626f4e1f89ab4be6b876ef91e89dfa before cb52f9f188c3174761ad3b37db9de751e002b52c; from 414fd46e77626f4e1f89ab4be6b876ef91e89dfa before a644f09b2090ad22a13fbcf9d141084f573108ef | CNA record |
References
- https://git.kernel.org/stable/c/874fd58b321a9238e47c2a46345444287f2a5781
- https://git.kernel.org/stable/c/c2edf376d7804279878b207d93ffe6009c8d3d29
- https://git.kernel.org/stable/c/5c90f99ba74b55ddd8e919224921033cc4077f01
- https://git.kernel.org/stable/c/e560bdf62b11dcaa2a018345f76869d89ed43a9e
- https://git.kernel.org/stable/c/9fd6d0861ae2fd44c771d6bc93b29bbc1202fe8e
- https://git.kernel.org/stable/c/c2a5e591858629b6c0e284010d2ccdbc22fd0a43
- https://git.kernel.org/stable/c/cb52f9f188c3174761ad3b37db9de751e002b52c
- https://git.kernel.org/stable/c/a644f09b2090ad22a13fbcf9d141084f573108ef
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.