Cloudanix VulnDB

CVE-2026-98535

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small bookkeeping error in one Linux driver could slowly waste system resources until fixed by a routine kernel update.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The read_dts_node() function in the fsl/fman driver calls of_clk_get() which increments a clock reference count but never calls clk_put() to release it after reading the rate, and the reference is not stored for later cleanup.

Why it matters to the business

Over time this can cause gradual resource exhaustion or unexpected behavior in affected Linux kernel configurations using the fsl/fman driver, increasing maintenance overhead and potential downtime risk for systems that remain unpatched.

How an attack unfolds

An attacker would need local access to trigger repeated loading or initialization paths in the fsl/fman driver that invoke read_dts_node(), accumulating unreleased clock references until system resources are impacted; no remote vector or known threat actor usage exists.

How to fix it

Update to a Linux kernel version containing the fix that adds clk_put() after reading the clock rate in read_dts_node(); backport the patch to any custom kernels still carrying the leak.

How to confirm the fix worked

Confirm the presence of the clk_put() call immediately after of_clk_get() and rate read in read_dts_node(); review kernel logs for repeated clock acquisition without matching release messages during driver initialization.

Typical attack path

  1. Obtain local access to a system running an affected kernel with fsl/fman enabled
  2. Trigger device tree parsing or driver probe paths that call read_dts_node()
  3. Repeat to accumulate unreleased clock references
  4. Observe resource pressure or instability

How to detect it

Search kernel source or running systems for the read_dts_node function lacking a clk_put call after of_clk_get; review dmesg or driver probe logs for clock rate reads without subsequent release indicators.

What your security team should do

  • Prioritize kernel updates on any systems using the fsl/fman driver within the next patch cycle
  • Audit custom or downstream kernels for the missing clk_put() call
  • Monitor EPSS and KEV status for any future changes despite current low scores

The record

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either. Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.

Affected packages

Ecosystem Package Introduced Fixed