In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data The… (CVE-2026-98667)

The Linux kernel vulnerability CVE-2026-98667 involves incomplete initialization of the clk_init_data and clk_parent_data structures in the iio frequency driver adf4377. Specifically, adf4377_clk_register() assumed parent_names was NULL without initializing it and only partially initialized parent_data.fw_name, leaving other members uninitialized. This could lead to crashes under specific kernel configurations that detect uninitialized stack variables. The patch fully initializes all members to prevent subtle bugs and future breakage when changing driver parent specification methods.

The vulnerability could cause kernel crashes due to uninitialized data structures in the clock initialization code of the adf4377 driver. This impacts system stability under certain kernel configurations that enable stack initialization patterns. There is no indication of code execution or privilege escalation from this issue.

A fix is available that fully initializes all members of clk_init_data and clk_parent_data in the adf4377 driver. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation.