CVE-2026-89769

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89769", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.765Z", "datePublished": "2026-09-11T19:47:08.870Z", "dateUpdated": "2026-10-19T08:52:22.773Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:52:22.773Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path\n\nWhen cpuhp_setup_state fails after pit_clockevent_per_cpu_init has\nsuccessfully called request_irq, the error handling jumps directly to\nout_pit_clocksource_unregister without freeing the registered IRQ.\n\nThis leaks the IRQ line and, since kfree(pit) follows, leaves a\ndangling pointer registered as the interrupt handler's dev_id,\npotentially leading to a use-after-free if the IRQ fires afterwards.\n\nFix it by calling pit_clockevent_per_cpu_exit to properly release the\nIRQ before falling through to the existing cleanup chain."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is in pit_timer_init() of the NXP PIT clocksource driver (S32G2/S32G3 automotive SoCs and Vybrid vf610), reached only via local device-tree platform/timer probe at boot. Network, Bluetooth, USB, or other remote paths cannot reach this cpuhp error path.\nAC:H - The dangling IRQ action is planted only when cpuhp_setup_state() fails after request_irq() (dynamic CPUHP slot exhaustion or irq_force_affinity failure). Those resource/hotplug failures, and a later interrupt on the already-disabled PIT line, are conditions the attacker cannot reliably induce.\nPR:N - pit_timer_probe() and TIMER_OF_DECLARE pit_timer_init() run automatically from kernel timer/platform init on matching device-tree nodes, with no credential, capability, or authentication check before request_irq() and the cpuhp error path.\nUI:N - No victim action such as mounting a filesystem, opening a device, or plugging hardware is required. The leaky cleanup runs during unattended probe, and a later PIT IRQ or sched_clock read can consume the dangling state without another user.\nS:U - The leaked IRQ handler and kfree'd pit_timer object remain in the host kernel on the same S32G/Vybrid Linux instance. This is standard in-kernel use-after-free, not a VM escape, IOMMU bypass, or cross-OS partition breakout.\nC:H - On the cpuhp failure path the driver kfree()s pit while pit_timer_interrupt remains registered with &pit->ced as dev_id, a use-after-free that per kernel CNA guidance enables arbitrary kernel memory disclosure via slab reuse.\nI:H - The same dangling ISR invokes ced->event_handler on the freed clock_event_device; reclaiming that heap object yields a function-pointer hijack and arbitrary-write primitive consistent with kernel UAF scoring.\nA:H - An IRQ hitting pit_timer_interrupt after kfree, irq_dispose_mapping of a still-requested line, or sched_clock reads of iounmapped PIT MMIO can oops or panic the kernel, fully denying availability on affected automotive and embedded systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "versions": [{"version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "lessThan": "d53c29a89a15e56a1797f3ef249955e544782e04", "status": "affected", "versionType": "git"}, {"version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "lessThan": "cdcd861123248e871c2ec2be968b0a1b2a5a34b0", "status": "affected", "versionType": "git"}, {"version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "lessThan": "05520e035f8332c8e33f3011b5ca016fde61793d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04"}, {"url": "https://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0"}, {"url": "https://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d"}], "title": "clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d53c29a89a15e56a1797f3ef249955e544782e04", "status": "affected", "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "versionType": "git"}, {"lessThan": "cdcd861123248e871c2ec2be968b0a1b2a5a34b0", "status": "affected", "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "versionType": "git"}, {"lessThan": "05520e035f8332c8e33f3011b5ca016fde61793d", "status": "affected", "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path\n\nWhen cpuhp_setup_state fails after pit_clockevent_per_cpu_init has\nsuccessfully called request_irq, the error handling jumps directly to\nout_pit_clocksource_unregister without freeing the registered IRQ.\n\nThis leaks the IRQ line and, since kfree(pit) follows, leaves a\ndangling pointer registered as the interrupt handler's dev_id,\npotentially leading to a use-after-free if the IRQ fires afterwards.\n\nFix it by calling pit_clockevent_per_cpu_exit to properly release the\nIRQ before falling through to the existing cleanup chain."}], "id": "CVE-2026-89769", "lastModified": "2026-10-19T09:18:20.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:20:08.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Use-after-free due to IRQ leak in NXP PIT clocksource driver", "id": "2532161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532161"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's NXP PIT (Programmable Interrupt Timer) clocksource driver. When the CPU hotplug setup fails after an interrupt request (IRQ) has been successfully registered, the error handling does not properly free the IRQ. This oversight results in a leaked IRQ line and a dangling pointer, which could lead to a use-after-free vulnerability if the IRQ is subsequently triggered. A local attacker could potentially exploit this to cause system instability or execute arbitrary code."], "name": "CVE-2026-89769", "public_date": "2026-09-11T19:47:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89769\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89769\nhttps://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d\nhttps://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0\nhttps://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee33f22d7c30626e711b4900e3f460b6e0e104f,d53c29a89a15e56a1797f3ef249955e544782e04)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee33f22d7c30626e711b4900e3f460b6e0e104f,cdcd861123248e871c2ec2be968b0a1b2a5a34b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee33f22d7c30626e711b4900e3f460b6e0e104f,05520e035f8332c8e33f3011b5ca016fde61793d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.50,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.4,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T05:00:08.297823+00:00", "updated": "2026-09-15T19:15:16.156119+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}