CVE-2026-98746 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
A clock reference leak in the ma35d1 serial driver can lead to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98746?
CVE-2026-98746 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
of_clk_get() returns a clock with a reference that has to be released with clk_put(). ma35d1serial_probe() never does that, so the reference is leaked on the probe error paths and also when the port is removed.
Release it on the error paths and in ma35d1serial_remove().
Which versions are affected by CVE-2026-98746?
How do I fix CVE-2026-98746?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98746 being exploited?
There is no known exploitation of CVE-2026-98746 in the wild and no public exploit code.
Sources
Also known as AZL-108846, BELL-CVE-2026-98746, DEBIAN-CVE-2026-98746, GHSA-74wj-7f7x-fq68, UBUNTU-CVE-2026-98746.