8

CVE-2026-89947

clk: meson: align gxbb_32k_clk_sel number of parents with actual count

In the Linux kernel, the following vulnerability has been resolved:

clk: meson: align gxbb_32k_clk_sel number of parents with actual count

The following out-of-bounds read has been observed by Christian on a
GXBB WeTek Hub:
==================================================================
BUG: KASAN: global-out-of-bounds in __clk_register+0x1b70/0x2418
Read of size 8 at addr ffffd66320cf88e0 by task swapper/0/1

CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc5 #1 PREEMPT
Hardware name: WeTek Hub (DT)
Call trace:
 show_stack+0x14/0x20 (C)
 dump_stack_lvl+0x74/0x94
 print_report+0x164/0x4b0
 kasan_report+0x98/0xd8
 __asan_report_load8_noabort+0x1c/0x24
 __clk_register+0x1b70/0x2418
 devm_clk_hw_register+0x74/0x15c
 meson_clkc_init+0xd4/0x20c
 meson_clkc_syscon_probe+0x5c/0x94
 platform_probe+0xbc/0x17c
 really_probe+0x184/0x844
 __driver_probe_device+0x154/0x35c
 driver_probe_device+0x60/0x188
 __driver_attach+0x168/0x4a0
 bus_for_each_dev+0xec/0x180
 driver_attach+0x38/0x58
 bus_add_driver+0x238/0x4c0
 driver_register+0x150/0x388
 __platform_driver_register+0x54/0x7c
 gxbb_clkc_driver_init+0x18/0x20
 do_one_initcall+0xb8/0x340
 kernel_init_freeable+0x49c/0x52c
 kernel_init+0x24/0x148
 ret_from_fork+0x10/0x20

The buggy address belongs to the variable:
 gxbb_32k_clk_parents+0x60/0x400

The buggy address belongs to a vmalloc virtual mapping
The buggy address belongs to the physical page:

Memory state around the buggy address:
 ffffd66320cf8780: 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
 ffffd66320cf8800: 00 04 f9 f9 f9 f9 f9 f9 00 04 f9 f9 f9 f9 f9 f9
>ffffd66320cf8880: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
                                                       ^
 ffffd66320cf8900: 00 01 f9 f9 f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9
 ffffd66320cf8980: 00 00 02 f9 f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9
==================================================================

Commit 7915d7d5407c ("clk: amlogic: gxbb: drop non existing 32k clock
parent") dropped a non-existing clock parent from the gxbb_32k_clk_sel
mux but didn't adjust the hard-coded num_parents field. Fix the actual
number of parents of that mux by using ARRAY_SIZE instead (avoiding
similar problems in future).
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version b9778cd803b330b8d7a9b523743c35093454b77f
Version < c86214e6178c38a0eff39110a4e92b824f5dd403
Status affected
Version f95e0f36e592e17a24ba4f56c355946448f84291
Version < 8b2f7a411e7ceaef268355c2150c22ee3f509c3b
Status affected
Version 6ded8c22af4700bbf91da24ac025f9d05b879267
Version < 1e509a6707d2fd9da79bdfa24742661b34562bfd
Status affected
Version 7061afacc89dec3f02f7412653b83f148a0c646b
Version < 404079d124d75a5da16322acc53d3ffc50b4ec68
Status affected
Version 4d32504f7ae951600e216aac4e04c81b02421a9d
Version < f6ff0e6995dbff5cb145d7795c8f0af9c168094a
Status affected
Version 7915d7d5407c026fa9343befb4d3343f7a345f97
Version < 4582949b7badcb91bb537ca522d69b8a35131e72
Status affected
Version 7915d7d5407c026fa9343befb4d3343f7a345f97
Version < bf85bd6e550c17ffa585606fcc18eb5b7c95bbce
Status affected
Version 7915d7d5407c026fa9343befb4d3343f7a345f97
Version < 628b6fee9fca292f12d07f0f1bcf1edefa949d81
Status affected
Version 450a1d9eac98886c7d19586dd10e72a4eaf8e1bc
Status affected
Version f18b09c998002ed6a67d1a235f3941a2662f1036
Status affected
Version 1eb7a2f3e25075b2dc9b10c94616b066f80e79ee
Status affected
Version 5.10.236
Version < 5.10.270
Status affected
Version 5.15.180
Version < 5.15.221
Status affected
Version 6.1.134
Version < 6.1.188
Status affected
Version 6.6.87
Version < 6.6.157
Status affected
Version 6.12.23
Version < 6.12.110
Status affected
Version 5.4.292
Version < 5.5
Status affected
Version 6.13.11
Version < 6.14
Status affected
Version 6.14.2
Version < 6.15
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.15
Status affected
Version 0
Version < 6.15
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.5
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.081
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8 2.5 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/c86214e6178c38a0eff39110a4e92b824f5dd403
https://git.kernel.org/stable/c/8b2f7a411e7ceaef268355c2150c22ee3f509c3b
https://git.kernel.org/stable/c/1e509a6707d2fd9da79bdfa24742661b34562bfd
https://git.kernel.org/stable/c/404079d124d75a5da16322acc53d3ffc50b4ec68
https://git.kernel.org/stable/c/f6ff0e6995dbff5cb145d7795c8f0af9c168094a
https://git.kernel.org/stable/c/4582949b7badcb91bb537ca522d69b8a35131e72
https://git.kernel.org/stable/c/bf85bd6e550c17ffa585606fcc18eb5b7c95bbce
https://git.kernel.org/stable/c/628b6fee9fca292f12d07f0f1bcf1edefa949d81