Executive brief
A vulnerability was discovered in the Linux kernel's driver for Microchip PolarFire SoC hardware. The issue occurs when the system attempts to register certain clock components, potentially leading to an out-of-bounds memory access. While primarily a stability issue that could cause a system crash, it represents a flaw in how the kernel manages hardware resources.
Technical details
An out-of-bounds access vulnerability exists in `drivers/clk/microchip/clk-mpfs-ccc.c` during the registration of clock outputs. The root cause is a mismatch between the allocated size of the `hws` array and the clock IDs being processed; the array is sized for supported Phase-Locked Loops (PLLs), but the ID space includes unsupported Delay-Locked Loops (DLLs), leading to an index overflow. An attacker with the ability to trigger clock registration or probe the driver could potentially cause a kernel oops or memory corruption. The fix involves decrementing the PLL output IDs to correctly map them into the allocated array space.
Affected products
- Linux Linux kernel PolarFire SoC fabric clock support (mpfs-ccc) driver
Timeline
- 2026-02-24: disclosed: Initial patch authored
- 2026-06-08: advisory: CVE published
References
- https://git.kernel.org/stable/c/2f7ae8ab6aa73daaf080d5332110357c29df9c36
- https://git.kernel.org/stable/c/47bc7a03449c39805bc2665d3e57c73195d5bcf8
- https://git.kernel.org/stable/c/9ed9b580a814773482c0a4f1be045636e68cc109
- https://git.kernel.org/stable/c/a0780aeea166a7cf4706c45af4cadbb2a43a1fc9
- https://git.kernel.org/stable/c/dbfcb09656cb30439577325c9dea2250203c2e3c
- https://git.kernel.org/stable/c/f24efd415455b98a1f1cfc6071fe6fde71986706