CVE-2026-98667 Overview
CVE-2026-98667 is an uninitialized memory use vulnerability in the Linux kernel's Industrial I/O (IIO) frequency driver for the Analog Devices ADF4377 synthesizer. The adf4377_clk_register() function populates init.parent_data while leaving init.parent_names and other members of the clk_parent_data structure uninitialized. When CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled, the stale stack contents can trigger a crash during clock registration. The issue has been resolved upstream by fully initializing the clk_init_data and clk_parent_data structures.
Critical Impact
Uninitialized clk_parent_data members in the ADF4377 driver can cause kernel crashes on systems using specific stack initialization configurations.
Affected Products
- Linux kernel versions containing the drivers/iio/frequency/adf4377.c driver prior to the fix
- Kernels built with CONFIG_INIT_STACK_ALL_PATTERN enabled
- Kernels built with CONFIG_INIT_STACK_NONE enabled
Discovery Timeline
- 2026-10-18 - CVE-2026-98667 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98667
Vulnerability Analysis
The clk_init_data structure in the Linux Common Clock Framework exposes several mutually-exclusive members for describing a clock's parents, including parent_names, parent_data, and parent_hws. Driver authors typically populate only the member relevant to their parent-specification method. The ADF4377 IIO frequency driver fills in init.parent_data but does not explicitly set init.parent_names to NULL.
When the kernel is configured with CONFIG_INIT_STACK_ALL_PATTERN, uninitialized stack memory is filled with a non-zero pattern. The clock framework then dereferences the pattern-filled parent_names pointer, producing a crash. The same latent defect applies to the clk_parent_data structure, where only fw_name is assigned and the remaining members retain stale stack data.
Root Cause
The root cause is incomplete initialization of structures passed to the clock framework. Reliance on implicit zero-initialization of local structures breaks when stack-initialization policies change the uninitialized state from zero to a defined pattern or to indeterminate values.
Attack Vector
The condition is triggered during normal driver probe of ADF4377 hardware when the kernel is built with specific CONFIG_INIT_STACK_* options. No remote attack vector has been published, and the issue manifests as a reliability defect rather than a documented path to code execution. Exploitation requires local kernel configuration and hardware presence conditions.
See the upstream fixes for the exact code changes: Linux kernel commit 6564f394 and Linux kernel commit e787fd23.
Detection Methods for CVE-2026-98667
Indicators of Compromise
- Kernel oops or panic traces referencing clk_register, __clk_core_init, or adf4377_clk_register during driver probe
- Crash signatures containing dereferences of pointer values matching the stack-initialization pattern (for example, 0xAAAAAAAAAAAAAAAA)
- Boot failures or device-tree probe failures on systems with ADF4377 hardware
Detection Strategies
- Inventory kernel builds to identify images with CONFIG_INIT_STACK_ALL_PATTERN=y combined with the vulnerable adf4377 driver.
- Review dmesg output and persistent kernel logs for recurring crashes tied to IIO clock registration.
- Compare running kernel versions against the upstream stable commits referenced in the advisory.
Monitoring Recommendations
- Forward kernel ring-buffer logs to a centralized logging platform and alert on oops signatures involving the clock framework.
- Track kernel package versions across Linux fleets to confirm patched builds are deployed to systems using ADF4377 hardware.
- Correlate device probe failures with hardware inventory to identify systems exposed to the defect.
How to Mitigate CVE-2026-98667
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree once vendor-packaged kernels are available.
- Identify systems using the ADF4377 synthesizer and prioritize kernel updates on those hosts.
- Validate that reboot and probe operations complete cleanly on patched kernels before broad rollout.
Patch Information
The fix fully initializes both clk_init_data and clk_parent_data within adf4377_clk_register(), eliminating reliance on implicit zero-initialization. Patches are available in the mainline and stable trees via commit 6564f394 and commit e787fd23. Linux distribution vendors will backport these commits into supported kernel series.
Workarounds
- Rebuild affected kernels without CONFIG_INIT_STACK_ALL_PATTERN where feasible, understanding this reduces unrelated hardening.
- Disable or avoid loading the adf4377 driver on systems where the hardware is not required until patches are applied.
- Restrict physical and administrative access to systems with ADF4377 hardware until a fixed kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
