Executive brief
The Linux kernel's clock management subsystem in the Visconti platform contains an uninitialized data structure that can cause system crashes when certain kernel build configurations are enabled. This affects the reliability of systems running affected kernel versions, potentially leading to unexpected system instability.
Technical details
The vulnerability exists in the visconti_clk_register_gate() function within the Visconti clock driver. The clk_init_data structure was not fully initialized before use; specifically, the parent_names member was left uninitialized while parent_data was being set. This causes undefined behavior when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled, resulting in potential crashes. The fix initializes the entire structure with an empty initializer (init = {}) rather than leaving members uninitialized. The patch was merged upstream on 2026-08-19 and backported to stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions with Visconti clock driver support
Timeline
- 2026-09-17: disclosed: CVE-2026-90122 published
- 2026-08-19: patched: Upstream fix committed by Geert Uytterhoeven
- 2026-09-14: other: Backported to stable kernel branches