Skip to main content

Linux CVE-2026-98535

| EUVDEUVD-2026-103580
2026-10-18 Linux GHSA-qmfm-wg2c-j3hg
View
Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fsl/fman: Fix clk reference leak in read_dts_node()

of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either.

Release the clock once its rate has been read, which also covers the error path taken when the rate is zero.

Affected VersionsENISA

Linux patch: 7.2.9
Linux patch: 7.3-rc5
Linux patch: 0
Linux patch: 6.18.55
Linux patch: 5.10.271
Linux 4.5
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <c2a5e591858629b6c0e284010d2ccdbc22fd0a43
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <5c90f99ba74b55ddd8e919224921033cc4077f01
Linux patch: 6.12.112
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <c2edf376d7804279878b207d93ffe6009c8d3d29
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <cb52f9f188c3174761ad3b37db9de751e002b52c
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <e560bdf62b11dcaa2a018345f76869d89ed43a9e
Linux patch: 5.15.222
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <9fd6d0861ae2fd44c771d6bc93b29bbc1202fe8e
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <874fd58b321a9238e47c2a46345444287f2a5781
Linux patch: 6.1.189
Linux patch: 6.6.158
Linux 414fd46e77626f4e1f89ab4be6b876ef91e89dfa <a644f09b2090ad22a13fbcf9d141084f573108ef

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Lifecycle Timeline

2
Patch available
Oct 18, 2026 - 16:02 EUVD
CVE Published
Oct 18, 2026 - 15:17 cve.org
UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Data Quality
3 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity Not scored yet
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
No CVSS yet + weak signal (CWE or non-zero EPSS)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy