rtc: ac100: Assign .num before accessing .hws
In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS) about the number of elements in .hws[], so that it can warn when .hws[] is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in ac100_rtc_register_clks() due to .num being assigned only after every clkout clock has been stored in .hws[]. With CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC 15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report during probe, and with CONFIG_UBSAN_TRAP the first store traps. Initialize .num with AC100_CLKOUT_NUM, the number of elements .hws[] was allocated with, right after the allocation. That is the value the loop counter ends up at on the success path anyway, so the provider's behaviour is unchanged.
CVE-2026-98848
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98848
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"lessThan": "e77c5fc1f39fdb06ecd1f55b101eea1e1db2ffef",
"versionType": "git"
},
{
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"lessThan": "6bb55381daf1a1bed0657189a1396e7467712525",
"versionType": "git"
},
{
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"lessThan": "160619b38707241e22569f9c983a4b3d0890996a",
"versionType": "git"
},
{
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"lessThan": "ad1bf77039cba83373bf1eff3784655e3e3ed2ab",
"versionType": "git"
},
{
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"lessThan": "6a4117eee82dd85f11bf898bf66026764011eeb6",
"versionType": "git"
}
],
"programFiles": [
"drivers/rtc/rtc-ac100.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/rtc/rtc-ac100.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98848
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #49004 · Revision 1
- Added to Heist Feed
- Publisher date