CVE-2026-98825: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
In the Linux kernel, the following vulnerability has been resolved:
rtc: mpfs: fix unchecked devmclkget() error pointer in probe()
devmclkget(&pdev->dev, "rtcref")'s return value was passed straight into clkgetrate() without checking it for an error first, unlike the "rtc" clock a few lines above which is correctly checked with ISERR(). clkgetrate() only guards against a NULL clk, not an error pointer:
if (!clk) return 0; ... rate = clkcoregetraterecalc(clk->core);
so if devmclkget() ever returns an error pointer here (for example ERRPTR(-EPROBEDEFER), which is the normal, expected outcome if the clkcfg clock-provider this RTC depends on has not registered its clocks yet by the time this driver probes), clkgetrate() dereferences that error pointer instead of returning 0, crashing instead of letting probe defer.
Capture the clock in the existing 'clk' local and check it with ISERR() before calling clkgetrate(), matching the handling already used for the "rtc" clock in this same function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the Linux kernel rtc: mpfs driver probe() function, capture the "rtcref" clock returned by devm_clk_get(&pdev->dev, "rtcref") in the existing 'clk' local, check it with IS_ERR(), and only then call clk_get_rate(), matching the existing handling for the "rtc" clock.
Event History
Frequently Asked Questions
Under what condition can this issue cause a crash?
The RTC driver can crash when it probes before its clkcfg clock provider has registered the required "rtcref" clock. In that case, devm_clk_get() may return an error pointer, such as -EPROBE_DEFER, which is passed to clk_get_rate() and dereferenced.
What systems are realistically exposed?
Systems using the Linux kernel MPFS RTC driver and depending on the "rtcref" clock are exposed during driver probing when that clock is not yet available. The described expected trigger is a clock-provider registration ordering or timing condition.
What is the effect of the fix?
The fix checks whether obtaining the "rtcref" clock returned an error before calling clk_get_rate(). This allows probe deferral to proceed rather than dereferencing the error pointer and crashing.