---
id: CVE-2026-98848
title: 'kernel: rtc: ac100: Assign .num before accessing .hws (CVE-2026-98848)'
summary: >-
  A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver.
  During device probing, the driver accesses an internal array before
  initializing its element counter. On systems compiled with runtime bounds
  checking enabled, this…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-787
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 <
    e77c5fc1f39fdb06ecd1f55b101eea1e1db2ffef
  - >-
    Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 <
    6bb55381daf1a1bed0657189a1396e7467712525
  - >-
    Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 <
    160619b38707241e22569f9c983a4b3d0890996a
  - >-
    Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 <
    ad1bf77039cba83373bf1eff3784655e3e3ed2ab
  - >-
    Linux >= f316cdff8d677db9ad9c90acb44c4cd535b0ee27 <
    6a4117eee82dd85f11bf898bf66026764011eeb6
  - Linux 6.6
published: '2026-10-18'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:17:11+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98848.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98848.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98848'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555212'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98848'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98848'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98848.mbox
  - url: 'https://git.kernel.org/stable/c/e77c5fc1f39fdb06ecd1f55b101eea1e1db2ffef'
  - url: 'https://git.kernel.org/stable/c/6bb55381daf1a1bed0657189a1396e7467712525'
  - url: 'https://git.kernel.org/stable/c/160619b38707241e22569f9c983a4b3d0890996a'
  - url: 'https://git.kernel.org/stable/c/ad1bf77039cba83373bf1eff3784655e3e3ed2ab'
  - url: 'https://git.kernel.org/stable/c/6a4117eee82dd85f11bf898bf66026764011eeb6'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00157
epssPercentile: 0.04783
ingestedAt: '2026-10-18T16:47:32.464Z'
---

## Overview

A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. During device probing, the driver accesses an internal array before initializing its element counter. On systems compiled with runtime bounds checking enabled, this premature access triggers an out-of-bounds trap, allowing a local user capable of triggering device initialization to crash the system, resulting in a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98848.json)

**kernel: rtc: ac100: Assign .num before accessing .hws** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.