Linux Kernel Vulnerability in the AC100 RTC Firmware by Vendor

CVE-2026-98848

What is CVE-2026-98848?

A vulnerability in the AC100 RTC firmware within the Linux kernel has been identified, which affects the proper initialization of array bounds for the clock handling system. When the .num member of 'struct clk_hw_onecell_data' is not initialized before accessing the .hws[] array, it can lead to out-of-bounds access warnings. This issue arises in the ac100_rtc_register_clks() function where the assignment of .num occurs after accessing .hws[], resulting in potential runtime errors under certain configurations. The defect can trigger warnings or even traps during operations, necessitating immediate attention to prevent operational hazards.

References