In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure… (CVE-2026-98826)

The Linux kernel's ac100 RTC driver had a use-after-free vulnerability triggered on probe failure. The driver registers the RTC-32k clock and clock provider without device management, releasing them only on device removal. If devm_rtc_register_device() fails after clock registration, the clock provider remains in the global of_clk_providers list while the associated memory is freed, causing use-after-free on subsequent lookups. Additionally, the RTC-32k clock is leaked, causing duplicate registration failures on later probes. The fix changes registration to device-managed functions so resources are properly released on probe failure and device unbind, preventing use-after-free and leaks.

This vulnerability can lead to use-after-free conditions in the kernel clock provider infrastructure, potentially causing kernel instability or crashes when the freed memory is accessed. It also causes resource leaks that prevent successful re-probing of the device. There is no evidence of active exploitation in the wild.

A fix is available that changes the clock registration functions to device-managed variants, ensuring proper cleanup on probe failure and device removal. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required as the fix addresses the root cause.