CVE-2026-98001

Overview

The Linux kernel's ltc4282 hardware monitoring driver can leave the clk_init_data structure partially initialized, including an uninitialized num_parents field. This can cause a kernel crash when the driver is used with CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled. It matters because affected systems may experience a local denial-of-service condition if the driver is loaded and active.

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Make sure clk_init_data is fully initialized The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. ltc428_clk_provider_setup() does not fill in any parent clocks, and assumes that init.num_parents is NULL. However, the latter in uninitialized, and thus may cause a crash. Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.

Impact

Availability impact is the primary concern: an uninitialized clock parent count can lead to a kernel crash or panic. Confidentiality and integrity impact are not indicated by the description. Impacted users are administrators or users on systems running an affected Linux kernel with the ltc4282 driver loaded, particularly with the mentioned stack-initialization kernel options enabled. The issue is most relevant to embedded or hardware-monitoring platforms that use the LTC4282 driver.

Remediation

Apply a kernel update or vendor patch that fully initializes clk_init_data in the ltc4282 driver. If the LTC4282 hardware monitoring function is not required, prevent the ltc4282 module from loading by blacklisting it or removing it from the build. For systems that require the driver, prioritize kernel updates and verify the fix is present in the running kernel. Monitor kernel logs for crashes or probe failures and restrict unnecessary access to hardware monitoring interfaces until patched.

Risk context

The reported severity is medium with CVSS v3 5.5, and no EPSS score is provided. Urgency should be moderate for environments where the ltc4282 driver is active and availability is important, otherwise it can be treated as a routine kernel maintenance item.

Affected products

• Linux kernel
• ltc4282 hwmon driver
• Microchip LTC4282 hardware monitoring driver