{"id":"CVE-2026-98848","title":"kernel: rtc: ac100: Assign .num before accessing .hws (CVE-2026-98848)","summary":"A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. During device probing, the driver accesses an internal array before initializing its element counter. On systems compiled with runtime bounds checking enabled, this…","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-787","vendor":"Red Hat","product":"Linux","affected":["Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 < e77c5fc1f39fdb06ecd1f55b101eea1e1db2ffef","Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 < 6bb55381daf1a1bed0657189a1396e7467712525","Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 < 160619b38707241e22569f9c983a4b3d0890996a","Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 < ad1bf77039cba83373bf1eff3784655e3e3ed2ab","Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 < 6a4117eee82dd85f11bf898bf66026764011eeb6","Linux 6.6"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T11:17:11+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98848.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98848.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98848"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555212"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98848"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98848"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98848.mbox"},{"url":"https://git.kernel.org/stable/c/e77c5fc1f39fdb06ecd1f55b101eea1e1db2ffef"},{"url":"https://git.kernel.org/stable/c/6bb55381daf1a1bed0657189a1396e7467712525"},{"url":"https://git.kernel.org/stable/c/160619b38707241e22569f9c983a4b3d0890996a"},{"url":"https://git.kernel.org/stable/c/ad1bf77039cba83373bf1eff3784655e3e3ed2ab"},{"url":"https://git.kernel.org/stable/c/6a4117eee82dd85f11bf898bf66026764011eeb6"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00157,"epssPercentile":0.04783,"ingestedAt":"2026-10-18T16:47:32.464Z","slug":"CVE-2026-98848","body":"## Overview\n\nA flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. During device probing, the driver accesses an internal array before initializing its element counter. On systems compiled with runtime bounds checking enabled, this premature access triggers an out-of-bounds trap, allowing a local user capable of triggering device initialization to crash the system, resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98848.json)\n\n**kernel: rtc: ac100: Assign .num before accessing .hws** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228093,"id":"CVE-2026-98848","ts":1792758082900,"field":"cvss","old":null,"new":"4.1"},{"seq":228092,"id":"CVE-2026-98848","ts":1792758082900,"field":"severity","old":"none","new":"medium"}]}