CVE-2026-98848

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rtc: ac100: Assign .num before accessing .hws

Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with

__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'

with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)

about the number of elements in .hws[], so that it can warn when .hws[]

is accessed out of bounds. As noted in that change, the __counted_by

member must be initialized with the number of elements before the first

array access happens, otherwise there will be a warning from each access

prior to the initialization because the number of elements is zero.

This occurs in ac100_rtc_register_clks() due to .num being assigned only

after every clkout clock has been stored in .hws[]. With

CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC

15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report

during probe, and with CONFIG_UBSAN_TRAP the firs

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References