CVE-2026-98826

The AC100 RTC probe failure path can leave an OF clock provider registered after its device managed chip clk_data object has been freed. A later clock lookup for the same device tree node passes the dangling object to of_clk_hw_onecell_get, which reads freed num and hws fields and can return a stale clk_hw pointer to a consumer. The demonstrated primitive is a use-after-free read with a likely kernel crash or device initialization failure. A more serious consequence cannot be excluded because the freed object contains pointers that may be used by the clock subsystem after memory reuse. For the CVSS the PR:L value is used for the paranoid score because a local user may contribute to the required memory pressure without controlling the device directly, although reliable triggering normally requires an ENOMEM failure during probe and a later clock lookup. AC:H reflects this narrow timing and state requirement. The issue is not network reachable and affects systems with the AC100 RTC and a matching device tree clock consumer. Impact is at least local denial of service and the stale pointer path may allow confidentiality or integrity impact if the freed allocation is reused in a controllable way.