CVE-2026-90422 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
When mtk_clk_register_pllfhs function fails to register a PLL, it unregisters all PLLs and cleans up itself in its error path before returning, so the function callers don't need to do it.
But contrary to mtk_clk_unregister_pllfhs function, that does almost the same sequence, it does not free the IO memory mapped on fhctl node, leading to a leak.
Fix this leak by factorizing the cleanup sequence in a new private function and use it both mtk_clk_register_pllfhs and mtk_clk_unregister_pllfhs functions.
Also, change the loop index start value to avoid the -1 operation on index at each loop.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel clock framework for MediaTek platforms contains a resource management flaw within the pllfh driver that results in an input/output memory leak during error handling sequences. This vulnerability is rooted in the implementation of the mtk_clk_register_pllfhs function, which is responsible for registering phase-locked loops (PLLs) associated with specific hardware control nodes. When this registration process encounters a failure condition, such as a resource allocation issue or invalid configuration, the function attempts to clean up by unregistering any previously registered PLLs and resetting its internal state before returning an error code to the caller. This design assumes that callers will not need to perform additional cleanup for these specific resources because they were never fully committed to the system in a stable state. However, this assumption overlooks a critical resource allocation step: the mapping of input/output memory regions associated with the fhctl node.
The core technical flaw lies in the asymmetry between the registration and unregistration logic within the driver code. While the mtk_clk_unregister_pllfhs function correctly handles the deallocation of IO memory mapped to the fhctl node, the error path in mtk_clk_register_pllfhs fails to perform this same cleanup operation. Consequently, whenever a PLL registration failure occurs, the kernel retains a reference to and mapping of that IO memory without releasing it back to the system pool. Over time, particularly on systems where clock initialization is frequently retried or subjected to dynamic configuration changes, these unreleased mappings accumulate. This constitutes an input/output leak, which falls under CWE-401 (Missing Release of Memory after Effective Lifetime) and specifically relates to improper resource management during error handling paths as described in CWE-755 (Improper Handling of Exceptional Conditions).
The operational impact of this vulnerability is primarily characterized by gradual memory exhaustion within the kernel space. Although a single leak may seem negligible, repeated occurrences can lead to significant fragmentation of virtual address space and depletion of available IO mapping resources. In severe cases, this could prevent subsequent hardware initialization attempts from succeeding due to lack of available mappings, potentially causing system instability or failure to boot certain peripherals that rely on these clock domains. Furthermore, the presence of such leaks complicates debugging efforts by obscuring other potential issues with false positives in memory usage metrics and can contribute to overall system performance degradation as the kernel struggles to manage an ever-growing list of unmapped but reserved IO regions.
To mitigate this vulnerability, the fix involves refactoring the cleanup logic into a dedicated private function that is shared between both the registration error path and the unregistration routine. This ensures consistent resource deallocation regardless of whether the PLLs are being registered successfully or if the process fails midway. By centralizing the cleanup sequence, developers eliminate the risk of divergent behavior between setup and teardown operations. Additionally, the patch optimizes loop indexing to avoid unnecessary arithmetic operations on indices during iteration, improving code clarity and potentially reducing minor computational overhead. System administrators should ensure that their kernels are updated with this fix applied, as it addresses a fundamental flaw in resource lifecycle management within the MediaTek clock driver infrastructure. This update aligns with best practices for defensive programming by ensuring that all allocated resources are properly released upon any exit path from critical initialization functions.