Description
In the Linux kernel, the following vulnerability has been resolved:

rtc: ac100: Assign .num before accessing .hws

Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
about the number of elements in .hws[], so that it can warn when .hws[]
is accessed out of bounds. As noted in that change, the __counted_by
member must be initialized with the number of elements before the first
array access happens, otherwise there will be a warning from each access
prior to the initialization because the number of elements is zero.
This occurs in ac100_rtc_register_clks() due to .num being assigned only
after every clkout clock has been stored in .hws[]. With
CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC
15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report
during probe, and with CONFIG_UBSAN_TRAP the first store traps.

Initialize .num with AC100_CLKOUT_NUM, the number of elements .hws[] was
allocated with, right after the allocation. That is the value the loop
counter ends up at on the success path anyway, so the provider's
behaviour is unchanged.
Published: 2026-10-18
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Array Index Out of Bounds in Linux kernel RTC driver
Action: Assess Impact
AI Analysis

Impact

The vulnerability arises in the Linux kernel’s ac100 RTC driver where the .num field of struct clk_hw_onecell_data is not initialized before array accesses to .hws[]. This improper initialization can cause array‑index‑out‑bounds conditions, which, when UBSAN_BOUNDS is enabled, results in bounds violations being logged or trapped. The bug does not provide a direct code‑execution path but could lead to a kernel panic or corruption of kernel memory if triggered in a non‑sanitized build.

Affected Systems

The flaw affects any Linux kernel configuration that includes the ac100 RTC driver and the accompanying clock framework. No specific kernel version range is supplied in the CVE data, but the issue was addressed in a recent commit (f316cdff8d67). System administrators should verify that their kernel releases include this patch or that the ac100 driver is not present on unpatched systems.

Risk and Exploitability

The CVSS score is 4.1 and the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits. Because the bug is only triggered when UBSAN_BOUNDS or UBSAN_TRAP are enabled, the likelihood of exploitation under typical production kernels is low. If the driver is loaded on a system with UBSAN enabled, the first array access may trigger an out‑of‑bounds report or trap. The assessment of a moderate risk if the uninitialized .num field could be abused to access memory beyond its bounds is based on inference from the description; no direct exploit is reported.

Generated by OpenCVE AI on October 24, 2026 at 03:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel update that contains commit f316cdff8d67 which initializes .num before array access.
  • If an immediate kernel update is not possible, disable CONFIG_UBSAN_BOUNDS and CONFIG_UBSAN_TRAP for the build or avoid loading the ac100 RTC driver until patched.
  • Monitor system logs for UBSAN out‑of‑bounds warnings or kernel panics that may indicate the defect is still present.

Generated by OpenCVE AI on October 24, 2026 at 03:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4850-1 linux-6.12 security update
History

Sat, 24 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-129
CWE-457

Sat, 24 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 21 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
References

Sun, 18 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-129
CWE-457

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS) about the number of elements in .hws[], so that it can warn when .hws[] is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in ac100_rtc_register_clks() due to .num being assigned only after every clkout clock has been stored in .hws[]. With CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC 15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report during probe, and with CONFIG_UBSAN_TRAP the first store traps. Initialize .num with AC100_CLKOUT_NUM, the number of elements .hws[] was allocated with, right after the allocation. That is the value the loop counter ends up at on the success path anyway, so the provider's behaviour is unchanged.
Title rtc: ac100: Assign .num before accessing .hws
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-21T12:57:28.688Z

Reserved: 2026-09-25T10:25:14.373Z

Link: CVE-2026-98848

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:39.163

Modified: 2026-10-21T13:21:49.483

Link: CVE-2026-98848

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98848 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T04:00:16Z

Weaknesses