CVE-2026-98848 Overview
CVE-2026-98848 is a Linux kernel vulnerability in the ac100 real-time clock (RTC) driver. The flaw involves an out-of-bounds array access in ac100_rtc_register_clks() triggered by the __counted_by annotation on struct clk_hw_onecell_data. The .num field is assigned only after each clkout clock has been stored in .hws[], so every store before initialization is treated as out-of-bounds by the UBSAN bounds sanitizer. On kernels built with CONFIG_UBSAN_BOUNDS and a compiler implementing __counted_by (GCC 15.1+ or Clang 20.1+), the driver emits an array-index-out-of-bounds report during probe. With CONFIG_UBSAN_TRAP, the first store traps.
Critical Impact
Kernels built with CONFIG_UBSAN_TRAP crash during ac100 RTC driver probe, producing a denial-of-service condition on affected hardware.
Affected Products
- Linux kernel versions containing commit f316cdff8d67 (clk: Annotate struct clk_hw_onecell_data with __counted_by)
- Builds using GCC 15.1+ or Clang 20.1+ with CONFIG_UBSAN_BOUNDS enabled
- Systems using the X-Powers AC100 codec RTC driver (common on Allwinner SoC platforms)
Discovery Timeline
- 2026-10-18 - CVE-2026-98848 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98848
Vulnerability Analysis
The vulnerability resides in the ac100_rtc_register_clks() function of the AC100 RTC driver. The driver allocates a struct clk_hw_onecell_data containing a flexible array member .hws[] sized to AC100_CLKOUT_NUM entries. After upstream commit f316cdff8d67 annotated the hws member with __counted_by(num), the compiler and the bounds sanitizer treat .num as the authoritative element count for .hws[].
The driver loop populates .hws[i] for each registered clkout and only assigns .num after the loop completes. Because .num is zero when the loop begins, every indexed store to .hws[] violates the __counted_by contract. Builds with CONFIG_UBSAN_BOUNDS log an array-index-out-of-bounds warning for each store, while CONFIG_UBSAN_TRAP configurations convert the first violation into a trap that halts execution.
Root Cause
The root cause is an initialization ordering defect [CWE-129-adjacent]. The __counted_by annotation requires that the counter field be initialized to the valid element count before any indexed access occurs. The AC100 RTC driver violates this ordering by writing to .hws[] before setting .num.
Attack Vector
The issue is reachable only during driver probe on hardware that instantiates the AC100 RTC. No external attacker interaction is required. On vulnerable sanitizer-enabled kernels, the predictable trap can be used by a local actor with the ability to trigger device probe to cause a kernel-side denial of service.
No verified exploitation code is published for this issue. Refer to the upstream fixes referenced below for implementation details.
Detection Methods for CVE-2026-98848
Indicators of Compromise
- Kernel log entries containing UBSAN: array-index-out-of-bounds referencing the ac100-rtc driver or ac100_rtc_register_clks
- Kernel panics or traps during device probe on Allwinner platforms using the AC100 PMIC codec
- Repeated UBSAN reports pointing to clk_hw_onecell_data.hws[] access
Detection Strategies
- Audit running kernels for the presence of commit f316cdff8d67 without the corresponding ac100 fix commits (160619b, 6a4117e, 6bb5538, ad1bf77, e77c5fc)
- Review build configurations for CONFIG_UBSAN_BOUNDS and CONFIG_UBSAN_TRAP to identify kernels that will react to the defect
- Collect and parse dmesg output from affected hardware fleets for UBSAN warnings referencing the AC100 driver
Monitoring Recommendations
- Forward kernel ring buffer output to a centralized log pipeline and alert on UBSAN: strings tied to RTC subsystem symbols
- Track driver probe failures and unexpected system restarts on Allwinner-based embedded devices
- Correlate kernel version and compiler version metadata across the fleet to prioritize patch rollout
How to Mitigate CVE-2026-98848
Immediate Actions Required
- Apply the upstream stable kernel fixes referenced by commits 160619b, 6a4117e, 6bb5538, ad1bf77, and e77c5fc
- Rebuild and redeploy kernels for all affected embedded platforms using the AC100 RTC
- Validate boot and probe behavior on representative hardware after patching
Patch Information
The fix initializes .num with AC100_CLKOUT_NUM immediately after the clk_hw_onecell_data allocation, before any .hws[] store occurs. This matches the value the loop counter would otherwise reach on the success path, preserving existing provider behavior. The change is distributed across five stable branches via the kernel.org commits listed above.
Workarounds
- Disable CONFIG_UBSAN_TRAP in affected kernel builds to prevent the first out-of-bounds store from halting execution
- Build without CONFIG_UBSAN_BOUNDS where sanitizer coverage is not required, suppressing the warning path
- Use a compiler earlier than GCC 15.1 or Clang 20.1 that does not implement __counted_by enforcement as an interim measure only
# Verify whether a running kernel includes the fix
git log --oneline drivers/rtc/rtc-ac100.c | grep -E "160619b|6a4117e|6bb5538|ad1bf77|e77c5fc"
# Check sanitizer configuration on the current kernel
zcat /proc/config.gz | grep -E "CONFIG_UBSAN_BOUNDS|CONFIG_UBSAN_TRAP"
# Monitor for UBSAN reports from the AC100 RTC driver
dmesg | grep -i -E "ubsan.*ac100|ac100_rtc_register_clks"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
