CVE-2026-98825: Linux Kernel RTC Use-After-Free Vulnerability

CVE-2026-98825 Overview

CVE-2026-98825 is a null/error pointer dereference vulnerability in the Linux kernel's Microchip PolarFire SoC (MPFS) real-time clock (RTC) driver. The mpfs_rtc_probe() function passes the return value of devm_clk_get(&pdev->dev, "rtcref") directly into clk_get_rate() without first validating it with IS_ERR(). When the clock provider is not yet registered, devm_clk_get() returns an error pointer such as ERR_PTR(-EPROBE_DEFER). Because clk_get_rate() only checks for a NULL clock, it dereferences the error pointer and triggers a kernel crash instead of allowing probe deferral.

Critical Impact
A kernel crash during driver probe on Microchip PolarFire SoC systems whenever the clkcfg clock provider has not yet registered its clocks, preventing the RTC from loading and potentially producing a boot-time denial of service.

Affected Products

Linux kernel rtc-mpfs driver (Microchip PolarFire SoC RTC)
Linux stable branches referenced in commits 74dc7c5, 8a03f84, ab741d1, ac41b05, cfd70c9
Systems built on Microchip PolarFire SoC hardware using the in-tree RTC driver

Discovery Timeline

2026-10-18 - CVE-2026-98825 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98825

Vulnerability Analysis

The defect lives in the mpfs_rtc_probe() function of the rtc-mpfs driver. The driver retrieves two clocks during probe: rtc and rtcref. The rtc clock is correctly validated with IS_ERR() before use. The rtcref clock reference, by contrast, is passed straight into clk_get_rate() without any error check.

clk_get_rate() guards only against a NULL input. When devm_clk_get() cannot resolve the clock provider, it returns an encoded error pointer rather than NULL. The function then dereferences clk->core, resulting in a kernel oops. This blocks the deferred-probe mechanism that normally allows drivers to retry once dependencies become available.

Root Cause

The root cause is missing error-pointer validation on a clock lookup, a common pattern bug in Linux device drivers. The fix captures the return value of devm_clk_get() in the existing local clk variable and gates the clk_get_rate() call behind an IS_ERR() check, matching the handling already applied to the rtc clock in the same function.

Attack Vector

This vulnerability is a local reliability and availability defect, not a remotely reachable code-execution flaw. It triggers automatically during kernel boot or module load on affected Microchip PolarFire SoC platforms when the clkcfg provider is not yet ready. There is no indication of remote exploitability or privilege escalation. Impact is limited to systems that instantiate the rtc-mpfs driver.

See the upstream patches for the exact code change: Linux Kernel Commit - cfd70c9 and Linux Kernel Commit - ac41b05.

Detection Methods for CVE-2026-98825

Indicators of Compromise

Kernel panic or oops referencing mpfs_rtc_probe or clk_get_rate early in the boot log.
Repeated boot failures on Microchip PolarFire SoC hardware tied to RTC driver initialization.
Absence of the /dev/rtc0 device on PolarFire SoC systems that previously exposed one.

Detection Strategies

Inventory running kernel versions on PolarFire SoC assets and compare against the fixed commits in the stable tree.
Parse dmesg and persistent kernel crash logs for stack traces originating in drivers/rtc/rtc-mpfs.c.
Correlate device-tree configuration with kernel build to confirm whether the vulnerable driver is enabled (CONFIG_RTC_DRV_MPFS).

Monitoring Recommendations

Forward kernel ring-buffer and kdump output to a centralized log platform to capture probe-time panics.
Alert on boot-loop conditions and unexpected reboots on embedded PolarFire SoC fleets.
Track package and kernel versions across Linux hosts to confirm backported fixes have landed.

How to Mitigate CVE-2026-98825

Immediate Actions Required

Apply the upstream fix on affected Linux stable branches by updating to a kernel that includes the commits listed in the references.
Rebuild and redeploy custom kernels used on Microchip PolarFire SoC hardware with the patched rtc-mpfs driver.
Validate boot stability on representative devices before rolling out the updated kernel fleet-wide.

Patch Information

The fix captures the devm_clk_get() return value and validates it with IS_ERR() before calling clk_get_rate(). Patched commits are available in the upstream stable tree:

Workarounds

Disable CONFIG_RTC_DRV_MPFS in the kernel configuration on systems that do not require the MPFS RTC.
Remove the rtc-mpfs module from initramfs or boot image where RTC functionality can be deferred.
Ensure the clkcfg clock provider is probed and registered before the RTC driver loads where device-tree ordering is controllable.