CVE-2026-90126

In the Linux kernel, the following vulnerability has been resolved:

rtc: pcf8563: fix clock provider leak on unbind

pcf8563_clkout_register_clk() registers the CLKOUT clock provider with

of_clk_add_provider(), but nothing ever unwinds it: there is no

of_clk_del_provider() call and the driver has no remove callback. Each

of_clk_add_provider() allocates a struct of_clk_provider, takes a

reference on the OF node and adds an entry to the global of_clk_providers

list, none of which is released when the device is unbound. Every

bind/unbind (or module reload) therefore leaks a provider structure and

an of_node reference.

The clock itself is already device-managed (devm_clk_register()); only

the provider registration was not. Use devm_of_clk_add_hw_provider() so

the provider is removed automatically on unbind. Tie it to the parent

i2c device, whose OF node carries the #clock-cells and clock-output-names

properties (the RTC class device has no OF node of its own).