Executive brief
The Linux kernel's MediaTek clock driver contains a memory leak in its PLL frequency hopping (PLLFH) registration error handling. When PLL registration fails, the cleanup code fails to properly release IO-mapped memory for the frequency hopping control hardware, wasting system resources over time and potentially leading to memory exhaustion or performance degradation in systems relying on proper resource cleanup.
Technical details
The vulnerability is a resource leak in the mtk_clk_register_pllfhs function within drivers/clk/mediatek/clk-pllfh.c. When PLL registration fails in the error path, the function properly unregisters previously registered PLLs but fails to call iounmap() on the fhctl base IO address, unlike the corresponding mtk_clk_unregister_pllfhs cleanup function which does perform this cleanup. The fix introduces a shared cleanup function (mtk_clk_cleanup_pllfhs) that properly unmaps both the main IO base and fhctl base addresses, eliminating the inconsistency. This is a local kernel issue requiring no special privileges or network access to trigger; any caller attempting to register PLLs during a failure scenario will expose the leak.
Affected products
- Linux Linux kernel Affects multiple versions with MediaTek PLLFH support (kernel 5.x and later); patched in commit 540d91480bcb1b28a62d7023aa70947ea44c55b9 and later stable series
Timeline
- 2026-09-17: disclosed
- 2026-07-09: patched: Fix committed upstream as 540d91480bcb1b28a62d7023aa70947ea44c55b9
- 2026-09-17: advisory: CVE-2026-90422 published