CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved:

rtc: ac100: Assign .num before accessing .hws

Commit f316cdff8d67 ("clk: Annotate struct clk hw onecell data with counted by") annotated the hws member of 'struct clk hw onecell data' with counted by, which informs the bounds sanitizer (UBSAN BOUNDS) about the number of elements in .hws[], so that it can warn when .hws[] is accessed out of bounds. As noted in that change, the counted by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in ac100 rtc register clks() due to .num being assigned only after every clkout clock has been stored in .hws[]. With CONFIG UBSAN BOUNDS and a compiler that implements counted by (GCC 15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report during probe, and with CONFIG UBSAN TRAP the first store traps.

Initialize .num with AC100 CLKOUT NUM, the number of elements .hws[] was allocated with, right after the allocation. That is the value the loop counter ends up at on the success path anyway, so the provider's behaviour is unchanged.