CVE-2026-90126

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rtc: pcf8563: fix clock provider leak on unbind

pcf8563_clkout_register_clk() registers the CLKOUT clock provider with

of_clk_add_provider(), but nothing ever unwinds it: there is no

of_clk_del_provider() call and the driver has no remove callback. Each

of_clk_add_provider() allocates a struct of_clk_provider, takes a

reference on the OF node and adds an entry to the global of_clk_providers

list, none of which is released when the device is unbound. Every

bind/unbind (or module reload) therefore leaks a provider structure and

an of_node reference.

The clock itself is already device-managed (devm_clk_register()); only

the provider registration was not. Use devm_of_clk_add_hw_provider() so

the provider is removed automatically on unbind. Tie it to the parent

i2c device, whose OF node carries the #clock-cells and clock-output-names

properties (the RTC class device has no OF node of its own).

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References