CVE-2026-98848 rtc: ac100: Assign .num before accessing .hws

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: r...

EUVD-2026-103788

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

CVE-2026-98848

The Linux kernel contains a vulnerability in the rtc: ac100 component where the .num member of struct clk_hw_onecell_data is assigned after the first access to the .hws[] array. Due to previous annotations for UBSAN_BOUNDS , this causes an array-index-out-of-bounds report during probe with CONFIG...

CVE-2026-98826 rtc: ac100: Fix clock provider use-after-free on probe failure

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100rtcregisterclks registers the RTC-32k clock with clkhwregisterfixedrate and the clock provider with ofclkaddhwprovider. Neither is device managed, and both are...

CVE-2026-98826

In the Linux kernel, the following vulnerability has been resolved: r...

CVE-2026-98826

The Linux kernel contains a use-after-free vulnerability in the ac100 RTC driver. During a failed probe() operation, the driver fails to properly unregister the clock provider, leaving it on the global of_clk_providers list. Because the provider holds a pointer to chip->clk_data (which is free...