CVE-2026-90422
In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path When mtk_clk_register_pllfhs function fails to register a PLL, it unregisters all PLLs and cleans up itself in its error path before returning, so the function callers don't need to do it. But contrary to mtk_clk_unregister_pllfhs function, that does almost the same sequence, it does not free the IO memory mapped on fhctl node, leading to a leak. Fix this leak by factorizing the cleanup sequence in a new private function and use it both mtk_clk_register_pllfhs and mtk_clk_unregister_pllfhs functions. Also, change the loop index start value to avoid the -1 operation on index at each loop.
Affected versions
Linux kernel versions
6.2
and later are affected. Fixed in
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-90422?
CVE-2026-90422 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.2 onward and has been patched in 6.18.52, 7.2.6 and 7.3-rc1. CVE-2026-90422 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-90422?
Yes. CVE-2026-90422 has been patched. Fixed versions include 6.18.52, 7.2.6 and 7.3-rc1. If you are running Linux kernel 6.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-90422 actively exploited?
No. CVE-2026-90422 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.