CVE-2026-90422

Not scored yetLast modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path

When mtk_clk_register_pllfhs function fails to register a PLL, it unregisters all PLLs and cleans up itself in its error path before returning, so the function callers don't need to do it.

But contrary to mtk_clk_unregister_pllfhs function, that does almost the same sequence, it does not free the IO memory mapped on fhctl node, leading to a leak.

Fix this leak by factorizing the cleanup sequence in a new private function and use it both mtk_clk_register_pllfhs and mtk_clk_unregister_pllfhs functions.

Also, change the loop index start value to avoid the -1 operation on index at each loop.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d7964de8a8ea800910fdd4e365c42a9e7d5c54aa, < 6e3e93bc718c4fea556d7ca5fba07ab3511c9918; >= d7964de8a8ea800910fdd4e365c42a9e7d5c54aa, < 111235106099019b8a8d1947dc5c2674e0329ffa; >= d7964de8a8ea800910fdd4e365c42a9e7d5c54aa, < d35e45e5bad4fabcf122126402b6c6dcb4379672; >= d7964de8a8ea800910fdd4e365c42a9e7d5c54aa, < fea0b4fd891a2af77b55e05b950e7ea55b5d234e; >= d7964de8a8ea800910fdd4e365c42a9e7d5c54aa, < 540d91480bcb1b28a62d7023aa70947ea44c55b9
LinuxLinux6.2

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-904237.8In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_userCVE-2026-90424In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra24CVE-2026-904258.8In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra24CVE-2026-90426In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs teCVE-2026-904277.4In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_kreallCVE-2026-90428In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintCVE-2026-904297.8In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init CVE-2026-90430In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialiCVE-2026-90431In the Linux kernel, the following vulnerability has been resolved: remoteproc: Prevent crash handling to race with rproc_del() There's noCVE-2026-90432In the Linux kernel, the following vulnerability has been resolved: sched_ext: Abort directly from the hardlockup handler scx_hardlockup()CVE-2026-90433In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller iCVE-2026-90434In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofs_fill_pages() re
CVE-2026-90422: Unscored | Vulnix