CVE-2026-90422: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
In the Linux kernel, the following vulnerability has been resolved:
clk: mediatek: pllfh: Fix IO remapping leak in registerpllfhs error path
When mtkclkregisterpllfhs function fails to register a PLL, it unregisters all PLLs and cleans up itself in its error path before returning, so the function callers don't need to do it.
But contrary to mtkclkunregisterpllfhs function, that does almost the same sequence, it does not free the IO memory mapped on fhctl node, leading to a leak.
Fix this leak by factorizing the cleanup sequence in a new private function and use it both mtkclkregisterpllfhs and mtkclkunregisterpllfhs functions.
Also, change the loop index start value to avoid the -1 operation on index at each loop.
Event History
Frequently Asked Questions
Under what condition does the leak occur?
The leak occurs when mtk_clk_register_pllfhs fails while registering a PLL. Its error path unregisters PLLs but previously did not free the I/O memory mapped for the fhctl node.
Is cleanup required from callers when PLL registration fails?
No. The function handles its own error-path cleanup before returning, so callers do not need to unregister or otherwise clean up the PLLs.
What is the impact of the issue?
A failed PLL registration can leave mapped I/O memory allocated. The provided information describes a resource leak and does not state any attacker-controlled exploitation prerequisites or broader security impact.