CVE-2026-98825

In the Linux kernel, the following vulnerability has been resolved:

rtc: mpfs: fix unchecked devm clk get() error pointer in probe()

devm clk get(&pdev->dev, "rtcref")'s return value was passed straight into clk get rate() without checking it for an error first, unlike the "rtc" clock a few lines above which is correctly checked with IS ERR(). clk get rate() only guards against a NULL clk, not an error pointer:

if (!clk)
	return 0;
...
rate = clk core get rate recalc(clk->core);

so if devm clk get() ever returns an error pointer here (for example ERR PTR(-EPROBE DEFER), which is the normal, expected outcome if the clkcfg clock-provider this RTC depends on has not registered its clocks yet by the time this driver probes), clk get rate() dereferences that error pointer instead of returning 0, crashing instead of letting probe defer.

Capture the clock in the existing 'clk' local and check it with IS ERR() before calling clk get rate(), matching the handling already used for the "rtc" clock in this same function.