CVE-2026-98001 - Vulnerability Details

- hwmon: (ltc4282) Make sure clk_init_data is fully initialized

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ltc4282) Make sure clk_init_data is fully initialized

The clk_init_data structure contains several mutually-exclusive members
for different methods to specify the possible parents of a clock,
prompting drivers to initialize only the members they need. However,
not initializing all members may cause subtle issues, which are only
exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is
enabled.

ltc428_clk_provider_setup() does not fill in any parent clocks, and
assumes that init.num_parents is NULL. However, the latter in
uninitialized, and thus may cause a crash.

Make sure all members are fully initialized, to fix such bugs, and to
avoid future breakage when converting drivers to a different method for
specifying the parents.

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s hwmon driver for the ltc4282 monitoring device contains an uninitialized data flaw in the clk_init_data structure. Because the driver fails to initialize the init.num_parents member, the kernel may read garbage and crash, causing a system‑wide denial of service. The weakness aligns with CWE‑908. Based on the description, the bug results from insufficient initialization of mutually exclusive members that should be set before use.

Affected Systems

Any Linux kernel built with the ltc4282 hwmon driver and with either CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled is potentially vulnerable. The specific kernel versions are not listed in the supplied data, so any distribution using the current driver source under those configuration options is at risk.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector is local privilege via the hardware‑monitoring interface, allowing an attacker who can trigger the driver to induce a kernel panic. While no public exploits are documented, the crash can compromise availability, so patching or disabling the problematic configuration is recommended.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cbc29538dbf7d7400f1ffc5dd5713e6a551463a0`	affected	< c4a96da5a3f132d80aa971ddbeb86808539ba0e6
`cbc29538dbf7d7400f1ffc5dd5713e6a551463a0`	affected	< 80b46a3d066d4e2c1dd4edb90d4aa3f22ca79f39
`cbc29538dbf7d7400f1ffc5dd5713e6a551463a0`	affected	< aa08ce1ffaf36c7bdd3edd0ad65f72413639bfad
`cbc29538dbf7d7400f1ffc5dd5713e6a551463a0`	affected	< e317326d1755ea054b98e7a4833b929157461c35

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,c4a96da5a3f132d80aa971ddbeb86808539ba0e6)`	affected	code_commit	—
`[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,80b46a3d066d4e2c1dd4edb90d4aa3f22ca79f39)`	affected	code_commit	—
`[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,aa08ce1ffaf36c7bdd3edd0ad65f72413639bfad)`	affected	code_commit	—
`[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,e317326d1755ea054b98e7a4833b929157461c35)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	generic	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the patch to fully initialize clk_init_data in the ltc4282 hwmon driver.
If an immediate kernel update is not possible, rebuild the kernel with CONFIG_INIT_STACK_ALL_PATTERN and CONFIG_INIT_STACK_NONE disabled to avoid the uninitialized member.
Alternatively, apply the patch from the commit referenced in the provided kernel entry or recompile the affected driver with all members of clk_init_data initialized.

Generated by OpenCVE AI on October 1, 2026 at 04:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98001.mbox
https://git.kernel.org/stable/c/80b46a3d066d4e2c1dd4edb90d4aa3f22ca79f39
https://git.kernel.org/stable/c/aa08ce1ffaf36c7bdd3edd0ad65f72413639bfad
https://git.kernel.org/stable/c/c4a96da5a3f132d80aa971ddbeb86808539ba0e6
https://git.kernel.org/stable/c/e317326d1755ea054b98e7a4833b929157461c35
https://nvd.nist.gov/vuln/detail/CVE-2026-98001
https://www.cve.org/CVERecord?id=CVE-2026-98001

History

Wed, 30 Sep 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98001.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98001 https://www.cve.org/CVERecord?id=CVE-2026-98001
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Make sure clk_init_data is fully initialized The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. ltc428_clk_provider_setup() does not fill in any parent clocks, and assumes that init.num_parents is NULL. However, the latter in uninitialized, and thus may cause a crash. Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.
Title		hwmon: (ltc4282) Make sure clk_init_data is fully initialized
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/80b46a3d066d4e2c1dd4edb90d4aa3f22ca79f39 https://git.kernel.org/stable/c/aa08ce1ffaf36c7bdd3edd0ad65f72413639bfad https://git.kernel.org/stable/c/c4a96da5a3f132d80aa971ddbeb86808539ba0e6 https://git.kernel.org/stable/c/e317326d1755ea054b98e7a4833b929157461c35

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:29.325Z

Updated: 2026-10-19T09:12:07.015Z

Reserved: 2026-09-25T10:19:56.068Z

Link: CVE-2026-98001

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:28.320

Modified: 2026-10-19T10:17:51.477

Link: CVE-2026-98001

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98001 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T04:15:16Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object