GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89769 (GCVE-0-2026-89769)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:47 – Updated: 2026-09-13 06:34
VLAI
Title
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
Summary
In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has successfully called request_irq, the error handling jumps directly to out_pit_clocksource_unregister without freeing the registered IRQ. This leaks the IRQ line and, since kfree(pit) follows, leaves a dangling pointer registered as the interrupt handler's dev_id, potentially leading to a use-after-free if the IRQ fires afterwards. Fix it by calling pit_clockevent_per_cpu_exit to properly release the IRQ before falling through to the existing cleanup chain.
Severity
7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bee33f22d7c30626e711b4900e3f460b6e0e104f , < d53c29a89a15e56a1797f3ef249955e544782e04 (git)
Affected: bee33f22d7c30626e711b4900e3f460b6e0e104f , < cdcd861123248e871c2ec2be968b0a1b2a5a34b0 (git)
Affected: bee33f22d7c30626e711b4900e3f460b6e0e104f , < 05520e035f8332c8e33f3011b5ca016fde61793d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clocksource/timer-nxp-pit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d53c29a89a15e56a1797f3ef249955e544782e04",
              "status": "affected",
              "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f",
              "versionType": "git"
            },
            {
              "lessThan": "cdcd861123248e871c2ec2be968b0a1b2a5a34b0",
              "status": "affected",
              "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f",
              "versionType": "git"
            },
            {
              "lessThan": "05520e035f8332c8e33f3011b5ca016fde61793d",
              "status": "affected",
              "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clocksource/timer-nxp-pit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path\n\nWhen cpuhp_setup_state fails after pit_clockevent_per_cpu_init has\nsuccessfully called request_irq, the error handling jumps directly to\nout_pit_clocksource_unregister without freeing the registered IRQ.\n\nThis leaks the IRQ line and, since kfree(pit) follows, leaves a\ndangling pointer registered as the interrupt handler\u0027s dev_id,\npotentially leading to a use-after-free if the IRQ fires afterwards.\n\nFix it by calling pit_clockevent_per_cpu_exit to properly release the\nIRQ before falling through to the existing cleanup chain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in pit_timer_init() of the NXP PIT clocksource driver (S32G2/S32G3 automotive SoCs and Vybrid vf610), reached only via local device-tree platform/timer probe at boot. Network, Bluetooth, USB, or other remote paths cannot reach this cpuhp error path.\nAC:H - The dangling IRQ action is planted only when cpuhp_setup_state() fails after request_irq() (dynamic CPUHP slot exhaustion or irq_force_affinity failure). Those resource/hotplug failures, and a later interrupt on the already-disabled PIT line, are conditions the attacker cannot reliably induce.\nPR:N - pit_timer_probe() and TIMER_OF_DECLARE pit_timer_init() run automatically from kernel timer/platform init on matching device-tree nodes, with no credential, capability, or authentication check before request_irq() and the cpuhp error path.\nUI:N - No victim action such as mounting a filesystem, opening a device, or plugging hardware is required. The leaky cleanup runs during unattended probe, and a later PIT IRQ or sched_clock read can consume the dangling state without another user.\nS:U - The leaked IRQ handler and kfree\u0027d pit_timer object remain in the host kernel on the same S32G/Vybrid Linux instance. This is standard in-kernel use-after-free, not a VM escape, IOMMU bypass, or cross-OS partition breakout.\nC:H - On the cpuhp failure path the driver kfree()s pit while pit_timer_interrupt remains registered with \u0026pit-\u003eced as dev_id, a use-after-free that per kernel CNA guidance enables arbitrary kernel memory disclosure via slab reuse.\nI:H - The same dangling ISR invokes ced-\u003eevent_handler on the freed clock_event_device; reclaiming that heap object yields a function-pointer hijack and arbitrary-write primitive consistent with kernel UAF scoring.\nA:H - An IRQ hitting pit_timer_interrupt after kfree, irq_dispose_mapping of a still-requested line, or sched_clock reads of iounmapped PIT MMIO can oops or panic the kernel, fully denying availability on affected automotive and embedded systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:34:11.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d"
        }
      ],
      "title": "clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89769",
    "datePublished": "2026-09-11T19:47:08.870Z",
    "dateReserved": "2026-09-11T19:38:34.765Z",
    "dateUpdated": "2026-09-13T06:34:11.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89769",
      "date": "2026-09-15",
      "epss": "0.00121",
      "percentile": "0.02202"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89769\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:08.240\",\"lastModified\":\"2026-09-13T07:17:41.190\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path\\n\\nWhen cpuhp_setup_state fails after pit_clockevent_per_cpu_init has\\nsuccessfully called request_irq, the error handling jumps directly to\\nout_pit_clocksource_unregister without freeing the registered IRQ.\\n\\nThis leaks the IRQ line and, since kfree(pit) follows, leaves a\\ndangling pointer registered as the interrupt handler\u0027s dev_id,\\npotentially leading to a use-after-free if the IRQ fires afterwards.\\n\\nFix it by calling pit_clockevent_per_cpu_exit to properly release the\\nIRQ before falling through to the existing cleanup chain.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clocksource/timer-nxp-pit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bee33f22d7c30626e711b4900e3f460b6e0e104f\",\"lessThan\":\"d53c29a89a15e56a1797f3ef249955e544782e04\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bee33f22d7c30626e711b4900e3f460b6e0e104f\",\"lessThan\":\"cdcd861123248e871c2ec2be968b0a1b2a5a34b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bee33f22d7c30626e711b4900e3f460b6e0e104f\",\"lessThan\":\"05520e035f8332c8e33f3011b5ca016fde61793d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clocksource/timer-nxp-pit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.4,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:53:04+00:00",
      "cve": "CVE-2026-89769",
      "id": "CVE-2026-89769",
      "initial_release_date": "2026-09-11T19:47:08.870000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-after-free due to IRQ leak in NXP PIT clocksource driver",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89769.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.