In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock… (CVE-2026-98535)

The Linux kernel's fsl/fman driver had a reference leak vulnerability in the read_dts_node() function. The function of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only reads the clock rate and does not call clk_put() to decrement the reference count. Since the clock reference is not stored, it cannot be released later, leading to a resource leak. The fix involves releasing the clock reference immediately after reading the rate, covering normal and error cases.

The vulnerability causes a resource leak of clock references in the kernel, which could lead to increased resource consumption over time. There is no indication of direct security impact such as privilege escalation or code execution. The leak could potentially affect system stability or performance if the clock references accumulate.

A fix has been implemented in the Linux kernel to release the clock reference after reading the rate in read_dts_node(), including error paths. Users should update to the fixed kernel version when available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.