In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 ("clk:… (CVE-2026-98848)

The Linux kernel vulnerability CVE-2026-98848 involves the rtc: ac100 driver where the .num field, which indicates the number of elements in the .hws array, was assigned only after storing all clkout clocks in .hws[]. This caused the bounds sanitizer (UBSAN_BOUNDS) to report out-of-bounds accesses because .num was zero during the initial accesses. The issue was resolved by initializing .num with AC100_CLKOUT_NUM immediately after allocation, preventing out-of-bounds warnings or traps during probe when using compilers supporting __counted_by annotations (GCC 15.1+ or Clang 20.1+).

The vulnerability causes array-index-out-of-bounds warnings or traps during driver probe when using specific compiler and kernel configurations with bounds sanitization enabled. It does not indicate a direct security compromise or exploit in the wild but may cause kernel probe failures or instability under these conditions.

A fix is available that initializes the .num member before accessing the .hws array, preventing out-of-bounds accesses detected by the bounds sanitizer. Users should apply the official Linux kernel patch containing commit f316cdff8d67 or upgrade to a kernel version including this fix. No additional mitigation is required.