CVE-2026-98825

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()

devm_clk_get(&pdev->dev, "rtcref")'s return value was passed straight

into clk_get_rate() without checking it for an error first, unlike the

"rtc" clock a few lines above which is correctly checked with

IS_ERR(). clk_get_rate() only guards against a NULL clk, not an error

pointer:

if (!clk)

return 0;

...

rate = clk_core_get_rate_recalc(clk->core);

so if devm_clk_get() ever returns an error pointer here (for example

ERR_PTR(-EPROBE_DEFER), which is the normal, expected outcome if the

clkcfg clock-provider this RTC depends on has not registered its

clocks yet by the time this driver probes), clk_get_rate() dereferences

that error pointer instead of returning 0, crashing instead of letting

probe defer.

Capture the clock in the existing 'clk' local and check it with

IS_ERR() before calling clk_get_rate(), matching the handling already

used for the "

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References