CVE-2026-98535: Linux kernel · fsl/fman: Fix clk reference leak in read_dts_node()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in e560bdf62b11dcaa2a018345f76869d89ed43a9e : update Linux kernel when convenient.
Data as of 26 Oct 2026, 12:55 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in e560bdf62b11dcaa2a018345f76869d89ed43a9e, cb52f9f188c3174761ad3b37db9de751e002b52c, c2edf376d7804279878b207d93ffe6009c8d3d29 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in multiple Linux kernel commits. Users should update to a Linux kernel version that includes these fixes to resolve the clock reference leak. No additional mitigation is required beyond applying the official patch.
Description
A clock reference leak vulnerability in the Linux kernel's fsl/fman component was fixed. The function read_dts_node() called of_clk_get() to obtain a clock reference but did not release it with clk_put(), causing a reference count leak. This issue was addressed by releasing the clock after reading its rate, including on error paths.
References
- git.kernel.org/stable/c/874fd58b321a9238e47c2a46345444287f2a5781 (opens in a new tab)
- git.kernel.org/stable/c/c2edf376d7804279878b207d93ffe6009c8d3d29 (opens in a new tab)
- git.kernel.org/stable/c/5c90f99ba74b55ddd8e919224921033cc4077f01 (opens in a new tab)
- git.kernel.org/stable/c/e560bdf62b11dcaa2a018345f76869d89ed43a9e (opens in a new tab)
- git.kernel.org/stable/c/9fd6d0861ae2fd44c771d6bc93b29bbc1202fe8e (opens in a new tab)
- git.kernel.org/stable/c/c2a5e591858629b6c0e284010d2ccdbc22fd0a43 (opens in a new tab)
- git.kernel.org/stable/c/cb52f9f188c3174761ad3b37db9de751e002b52c (opens in a new tab)
- git.kernel.org/stable/c/a644f09b2090ad22a13fbcf9d141084f573108ef (opens in a new tab)