The ac100 RTC driver registers a clock provider and fixed‑rate clock without device‑managed ownership. If probe fails after these registrations—either due to devm_rtc_register_device returning –ENOMEM or an earlier error that skips provider registration—the provider remains in the global clock provider list while the memory owned by devm_kzalloc is freed. A subsequent call to of_clk_hw_onecell_get for the same device‑tree node enumerates the dangling provider, resulting in a read of freed memory. This use‑after‑free can corrupt kernel data structures and lead to a kernel panic or, if the attacker can influence the data read, arbitrary code execution. The weakness corresponds to improper resource cleanup during error handling (CWE‑416).

Any Linux kernel that includes the ac100 RTC driver in its source tree and has not applied the patch that moves the clock registrations into devres is vulnerable. The vulnerability exists in the driver code regardless of distribution or kernel version prior to the fix; therefore all unpatched installations that load the ac100 RTC module are affected.

The CVSS score of 4.7 indicates moderate impact, and the EPSS score of <1% suggests that exploitation is unlikely in the wild. However, based on the description, the likely attack vector is a local privileged process that can trigger the driver to probe a malformed or missing device‑tree node, causing probe failure. After the failure, any subsequent lookup of the provider—such as a power‑sequence node on a Sun4I SoC—is needed to reach the use‑after‑free. The vulnerability is not listed in the CISA KEV catalog, so no widely available exploits are known at this time.