In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()… (CVE-2026-98825)

The Linux kernel's rtc: mpfs driver had a flaw where the return value of devm_clk_get(&pdev->dev, "rtcref") was used directly in clk_get_rate() without verifying if it was an error pointer. clk_get_rate() only checks for NULL pointers, not error pointers, so if devm_clk_get() returned an error pointer (e.g., ERR_PTR(-EPROBE_DEFER)), clk_get_rate() would dereference it, causing a kernel crash. The issue was resolved by capturing the clock in a local variable and checking it with IS_ERR() before calling clk_get_rate(), aligning with the existing handling of the "rtc" clock in the same function.

If unpatched, this vulnerability could cause the Linux kernel to crash during the probe phase of the rtc: mpfs driver when the dependent clock provider has not yet registered its clocks. This results in a denial of service due to kernel panic or crash. There is no indication of code execution or privilege escalation from this issue.

A fix is available that adds proper error checking of the devm_clk_get() return value using IS_ERR() before calling clk_get_rate(). Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel-level vulnerability, updating to a kernel version containing this fix is the recommended remediation.