CVE-2026-98746 Overview
CVE-2026-98746 is a resource management flaw in the Linux kernel's ma35d1 serial driver. The ma35d1serial_probe() function calls of_clk_get() to obtain a clock reference but never releases it with clk_put(). The reference leaks on probe error paths and when the port is removed. The issue has been resolved upstream through multiple stable-tree backports.
Critical Impact
Repeated probe failures or driver unbind cycles can exhaust clock reference counters, causing resource depletion on systems using the Nuvoton MA35D1 UART peripheral.
Affected Products
- Linux kernel versions containing the drivers/tty/serial/ma35d1_serial.c driver
- Systems using the Nuvoton MA35D1 SoC serial peripheral
- Stable kernel branches prior to the fix commits referenced by the maintainers
Discovery Timeline
- 2026-10-18 - CVE-2026-98746 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98746
Vulnerability Analysis
The ma35d1 UART driver obtains a clock handle during probe using of_clk_get(). This API returns a reference-counted clock pointer that the caller must release with clk_put() when the clock is no longer needed. The driver fails to call clk_put() on probe error paths and does not release the reference in ma35d1serial_remove().
Each failed probe attempt or driver removal increments the clock's reference count without a matching decrement. Over time, this prevents the clock subsystem from freeing associated resources and may block clock disable or framework cleanup operations tied to the device node.
This is a Memory Leak class defect in kernel resource management. The impact is confined to availability and resource integrity on affected embedded systems rather than privilege escalation or code execution.
Root Cause
The root cause is missing cleanup of a reference-counted resource. The driver's probe routine acquires a clock through of_clk_get() but neither the error-handling paths within ma35d1serial_probe() nor the corresponding ma35d1serial_remove() routine invoke clk_put() to balance the acquisition.
Attack Vector
The flaw is not remotely exploitable. Triggering it requires local operations that cause repeated driver probe failures or module unbind cycles on hardware using the MA35D1 serial controller. The attack surface is limited to embedded Linux targets with this specific peripheral enabled.
The upstream fix adds clk_put() calls on each probe error exit and in the remove callback. Refer to the stable kernel commits listed in the external references for the exact patch content: Kernel Commit 1b303d38, Kernel Commit 3cdad0c5, Kernel Commit 547c742f, Kernel Commit 98401cf9, and Kernel Commit d8233d6b.
Detection Methods for CVE-2026-98746
Indicators of Compromise
- Repeated probe failures logged for the ma35d1-uart device in dmesg
- Growth in clock reference counts for the MA35D1 UART clock visible under /sys/kernel/debug/clk/clk_summary
- Unexpected inability to disable or reparent the UART clock after module unload
Detection Strategies
- Audit running kernel versions on MA35D1-based devices against the fix commits in drivers/tty/serial/ma35d1_serial.c
- Monitor module load and unload events for the ma35d1_serial driver through kernel audit logs
- Review build configurations for CONFIG_SERIAL_MA35D1 and correlate with vendor firmware baselines
Monitoring Recommendations
- Collect dmesg and journald output from embedded fleets and alert on recurring probe errors
- Track kernel package versions across inventory to confirm patched builds are deployed
- Export clock framework statistics from debugfs where available for long-running devices
How to Mitigate CVE-2026-98746
Immediate Actions Required
- Identify Linux systems using the Nuvoton MA35D1 SoC with the ma35d1_serial driver enabled
- Schedule updates to a kernel build that includes one of the referenced stable fix commits
- Restrict local access to privileged users capable of binding and unbinding kernel drivers
Patch Information
The fix is distributed across multiple stable Linux kernel branches. Apply vendor-provided kernel updates that incorporate commits 1b303d38, 3cdad0c5, 547c742f, 98401cf9, or d8233d6b. Downstream distributions and board support packages for the Nuvoton MA35D1 should pick up the backport in their next kernel refresh.
Workarounds
- Avoid driver unbind and rebind cycles for the ma35d1_serial driver on unpatched systems
- Reboot affected devices to reset clock reference counters if resource exhaustion is observed
- Disable CONFIG_SERIAL_MA35D1 in kernel builds where the MA35D1 UART is not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
