CVE-2026-98676

iio: adc: ade9000: fix NULL pointer dereference in clkout registration

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ade9000: fix NULL pointer dereference in clkout registration

ade9000_setup_clkout() passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls clk_divider_recalc_rate(), which dereferences the address through readl(). As a result, probing an ADE9000 configured as a clock provider with an external input clock crashes.

CLKOUT passes CLKIN through without changing its rate. Register it as a 1:1 fixed-factor clock, which does not require register access.

This change does not affect the configuration using the internal clock, for which the driver does not register a clock provider.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 81de7b4619fc3682a3bedaa7e8d6b2d67ab4e10a to before d2400175228fbc10b29c49a7b5f70a7e80d144ddAffected
  • 81de7b4619fc3682a3bedaa7e8d6b2d67ab4e10a to before 134aa31a8d4e71f6ab1d155ad7b4502508832f72Affected
  • 81de7b4619fc3682a3bedaa7e8d6b2d67ab4e10a to before 49ee1c6a3ebda6b7de06b2961b0e09c1c3fe536aAffected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.