UnratedFix available
fsl/fman: Fix clk reference leak in read_dts_node()
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either. Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.271, 5.15.222, 6.1.189, 6.12.112, 6.18.55, 6.6.158, 7.2.9
- CVEs
- CVE-2026-98535
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 04:07 UTC · Revision 1
Source evidence
fsl/fman: Fix clk reference leak in read_dts_node()
core-osv · Original sourcePublished 18 Oct 2026, 15:17 UTC
In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either. Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.
osv:CVE-2026-98535
Kernel
Fixed versions: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9
Complete source record
{
"id": "266636b984ff8280f0b68e0e4185cb55eb01bd09aa502b8025ec1c447740ebae",
"url": "https://osv.dev/vulnerability/CVE-2026-98535",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "fsl/fman: Fix clk reference leak in read_dts_node()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either. Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.",
"evidence": "osv:CVE-2026-98535",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.271",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.222",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.189",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.158",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.112",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.55",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.9",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-98535",
"aliases": [
"CVE-2026-98535"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "414fd46e77626f4e1f89ab4be6b876ef91e89dfa"
},
{
"fixed": "874fd58b321a9238e47c2a46345444287f2a5781"
},
{
"fixed": "c2edf376d7804279878b207d93ffe6009c8d3d29"
},
{
"fixed": "5c90f99ba74b55ddd8e919224921033cc4077f01"
},
{
"fixed": "e560bdf62b11dcaa2a018345f76869d89ed43a9e"
},
{
"fixed": "9fd6d0861ae2fd44c771d6bc93b29bbc1202fe8e"
},
{
"fixed": "c2a5e591858629b6c0e284010d2ccdbc22fd0a43"
},
{
"fixed": "cb52f9f188c3174761ad3b37db9de751e002b52c"
},
{
"fixed": "a644f09b2090ad22a13fbcf9d141084f573108ef"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98535.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.5.0"
},
{
"fixed": "5.10.271"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.222"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.189"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.158"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.112"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.55"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.9"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98535.json"
}
}
],
"modified": "2026-10-28T02:30:42.290715090Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/5c90f99ba74b55ddd8e919224921033cc4077f01",
"https://git.kernel.org/stable/c/874fd58b321a9238e47c2a46345444287f2a5781",
"https://git.kernel.org/stable/c/9fd6d0861ae2fd44c771d6bc93b29bbc1202fe8e",
"https://git.kernel.org/stable/c/a644f09b2090ad22a13fbcf9d141084f573108ef",
"https://git.kernel.org/stable/c/c2a5e591858629b6c0e284010d2ccdbc22fd0a43",
"https://git.kernel.org/stable/c/c2edf376d7804279878b207d93ffe6009c8d3d29",
"https://git.kernel.org/stable/c/cb52f9f188c3174761ad3b37db9de751e002b52c",
"https://git.kernel.org/stable/c/e560bdf62b11dcaa2a018345f76869d89ed43a9e",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98535.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-98535",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98535.json"
}
},
"related_cves": [
{
"value": "CVE-2026-98535",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 510137,
"published_at": "2026-10-18T15:17:58.081+00:00"
}