In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration… (CVE-2026-98676)

The Linux kernel's ade9000 ADC driver had a vulnerability where ade9000_setup_clkout() passed a NULL pointer as the register address during divider clock registration. This led to a NULL pointer dereference when the common clock framework called clk_divider_recalc_rate(), which dereferenced the NULL address via readl(). This caused a kernel crash when probing an ADE9000 device configured as a clock provider with an external input clock. The vulnerability was resolved by changing the CLKOUT registration to a 1:1 fixed-factor clock that does not require register access, eliminating the NULL pointer dereference. The internal clock configuration remains unaffected as it does not register a clock provider.

The vulnerability causes a kernel crash (NULL pointer dereference) when an ADE9000 device is configured as a clock provider with an external input clock, potentially leading to denial of service on affected systems.

A fix is available that changes the clock registration method to avoid dereferencing a NULL pointer. Users should update to the Linux kernel version that includes this fix. No additional mitigation is required for configurations using the internal clock, as they are not affected.