Executive brief
A flaw in the Linux kernel's Amlogic clock management code causes an out-of-bounds memory read during clock initialization on certain devices. An attacker with physical access or local code execution capability could trigger a kernel crash or information leak by exploiting this memory safety violation.
Technical details
A global-out-of-bounds read vulnerability (CWE-125) exists in the Linux kernel's Amlogic clock subsystem (clk: meson). The gxbb_32k_clk_sel clock mux's num_parents field was hard-coded but not updated when a non-existent clock parent was dropped in commit 7915d7d5407c, causing the kernel to read beyond the bounds of the gxbb_32k_clk_parents array during clock registration. The vulnerability is triggered during kernel initialization on affected WeTek Hub devices when __clk_register() attempts to access parent clock references. Exploitation occurs at boot time, making it difficult for typical user-space attackers to trigger; however, the memory disclosure could leak kernel information or cause a denial-of-service through panic. The fix involves using ARRAY_SIZE() instead of a hard-coded value to ensure num_parents matches the actual parent array size.
Affected products
- Linux Linux kernel 5.10 through 7.0 (approximately; versions with gxbb clock driver)
Timeline
- 2026-09-16: disclosed