CVE-2026-98535: fsl/fman: Fix clk reference leak in read_dts_node()
In the Linux kernel, the following vulnerability has been resolved:
fsl/fman: Fix clk reference leak in readdtsnode()
ofclkget() returns a clock with its reference count incremented, but readdtsnode() only uses it to read the rate and never calls clkput(). The clock is not stored anywhere, so the reference cannot be released later either.
Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.
Affected Software
Event History
Frequently Asked Questions
What condition is required for the reference leak to occur?
The leak occurs when read_dts_node() obtains a clock through of_clk_get() and reads its rate without releasing the acquired clock reference with clk_put(). The affected path also includes the case where the clock rate is zero.
What is the practical impact of this issue?
Each affected execution can retain a clock reference that is not stored for later cleanup. This is a resource-management issue rather than an attacker-controlled memory corruption or privilege-escalation condition based on the available information.
What should be done if an affected kernel cannot be updated immediately?
The provided information identifies the corrective action as releasing the clock reference after reading its rate, including on the zero-rate error path. No configuration workaround, detection method, or operational mitigation is provided.