rtc: pcf8563: fix clock provider leak on unbind

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-90126
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-17 17:17:04 UTC
Updated2026-10-19 09:19:02 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563_clkout_register_clk() registers the CLKOUT clock provider with of_clk_add_provider(), but nothing ever unwinds it: there is no of_clk_del_provider() call and the driver has no remove callback. Each of_clk_add_provider() allocates a struct of_clk_provider, takes a reference on the OF node and adds an entry to the global of_clk_providers list, none of which is released when the device is unbound. Every bind/unbind (or module reload) therefore leaks a provider structure and an of_node reference. The clock itself is already device-managed (devm_clk_register()); only the provider registration was not. Use devm_of_clk_add_hw_provider() so the provider is removed automatically on unbind. Tie it to the parent i2c device, whose OF node carries the #clock-cells and clock-output-names properties (the RTC class device has no OF node of its own).

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 2b5622cf4ee218b6f98d31dbf3fbd44b9b6bd675 git Not specified
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 36cb00c33bd83e7ce31b5a9f1f7c70db0cb7776c git Not specified
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 30b7c63af50fe1464e7582a37de1ca4bd030ecc1 git Not specified
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 7afb8db47c4f107bce89cfe5115fb31ba7c94665 git Not specified
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 97edf3fd9a46ea89a167966991c0449cfa07b36f git Not specified
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 08a59c28c2bdbcd655e99526c86a41dc83834283 git Not specified
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 6218c0533a72235ec9c5f41b812c63d963bd4a3e git Not specified
CNA Linux Linux affected a39a6405d5f949bc651694028a55d74c514ef1f9 9c48a53685040bb0de45a640b34055cbbfc69d4f git Not specified
CNA Linux Linux affected 4.4 Not specified
CNA Linux Linux unaffected 4.4 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/6218c0533a72235ec9c5f41b812c63d963bd4a3e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/08a59c28c2bdbcd655e99526c86a41dc83834283 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/30b7c63af50fe1464e7582a37de1ca4bd030ecc1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9c48a53685040bb0de45a640b34055cbbfc69d4f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/97edf3fd9a46ea89a167966991c0449cfa07b36f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/36cb00c33bd83e7ce31b5a9f1f7c70db0cb7776c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7afb8db47c4f107bce89cfe5115fb31ba7c94665 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2b5622cf4ee218b6f98d31dbf3fbd44b9b6bd675 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report