{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98826 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98826 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98826 and fix it if it is affected.\n\nWhat it is: CVE-2026-98826 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98826 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98826/ (Markdown: https://insights.sbomify.com/CVE-2026-98826/index.md)","id":"CVE-2026-98826","markdown":"https://insights.sbomify.com/CVE-2026-98826/index.md","name":"CVE-2026-98826","record":{"aliases":["AZL-109260","BELL-CVE-2026-98826","DEBIAN-CVE-2026-98826","GHSA-vm74-3mf5-j459","UBUNTU-CVE-2026-98826"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A use-after-free in the Linux kernel AC100 RTC driver allows local attackers to execute code or cause a denial of service via probe failure.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Fix clock provider use-after-free on probe failure\n\nac100_rtc_register_clks() registers the RTC-32k clock with\nclk_hw_register_fixed_rate() and the clock provider with\nof_clk_add_hw_provider(). Neither is device managed, and both are\nreleased only from ac100_rtc_remove(). The driver core does not call\nremove() when probe() fails: really_probe() reaches probe_failed below\nthe device_remove() call and goes straight to releasing the device's\nmanaged resources.\n\nac100_rtc_probe() ends with\n\n\treturn devm_rtc_register_device(chip-\u003ertc);\n\nso if that fails after the clocks have been registered, the provider is\nleft on the global of_clk_providers list holding chip-\u003eclk_data, which\nwas allocated with devm_kzalloc() and is freed while probe() unwinds. A\nlater lookup on this device tree node then reads freed memory in\nof_clk_hw_onecell_get(). Consumers that do exactly that exist in tree:\nthe wifi power sequence nodes on sun8i-a83t-bananapi-m3 and\nsun8i-a83t-cubietruck-plus take \u003c\u0026ac100_rtc 1\u003e, and the sun9i-a80 boards\nroute osc32k through \u003c\u0026ac100_rtc 0\u003e. The window is narrow, as\ndevm_rtc_register_device() can only fail with -ENOMEM here, but the\nprovider is left dangling whenever it does.\n\nThe RTC-32k clock is leaked on the same path. Since clk_core_lookup()\nsearches a global list that is not scoped per device, __clk_register()\nrejects the duplicate name with -EEXIST, so the leak also makes a later\nprobe of the same device fail.\n\nThe error path that returns -EINVAL when the ADDA 4M parent clock cannot\nbe found leaks the RTC-32k clock in the same way. No provider has been\nregistered at that point, so that one is a leak rather than a\nuse-after-free.\n\nRegister both with devm_clk_hw_register_fixed_rate() and\ndevm_of_clk_add_hw_provider() so that they are released whenever the\ndevice goes away, on a failed probe as well as on unbind. Devres\nreleases in reverse order of acquisition, so the provider is removed\nbefore chip-\u003eclk_data is freed, and the clkout children are now\nunregistered before their parent rather than after it.\nac100_rtc_unregister_clks() and the remove callback then have nothing\nleft to do and are removed.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"rtc: ac100: Fix clock provider use-after-free on probe failure","id":"CVE-2026-98826","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE","id":"CVE-2026-98827"},"packages":[],"prev":{"headline":"rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()","id":"CVE-2026-98825"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel AC100 RTC driver allows local attackers to execute code or cause a denial of service via probe failure.","url":"https://insights.sbomify.com/CVE-2026-98826/"}