{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89769", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.765Z", "datePublished": "2026-09-11T19:47:08.870Z", "dateUpdated": "2026-09-11T19:47:08.870Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:47:08.870Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path\n\nWhen cpuhp_setup_state fails after pit_clockevent_per_cpu_init has\nsuccessfully called request_irq, the error handling jumps directly to\nout_pit_clocksource_unregister without freeing the registered IRQ.\n\nThis leaks the IRQ line and, since kfree(pit) follows, leaves a\ndangling pointer registered as the interrupt handler's dev_id,\npotentially leading to a use-after-free if the IRQ fires afterwards.\n\nFix it by calling pit_clockevent_per_cpu_exit to properly release the\nIRQ before falling through to the existing cleanup chain."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "versions": [{"version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "lessThan": "d53c29a89a15e56a1797f3ef249955e544782e04", "status": "affected", "versionType": "git"}, {"version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "lessThan": "cdcd861123248e871c2ec2be968b0a1b2a5a34b0", "status": "affected", "versionType": "git"}, {"version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "lessThan": "05520e035f8332c8e33f3011b5ca016fde61793d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04"}, {"url": "https://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0"}, {"url": "https://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d"}], "title": "clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d53c29a89a15e56a1797f3ef249955e544782e04", "status": "affected", "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "versionType": "git"}, {"lessThan": "cdcd861123248e871c2ec2be968b0a1b2a5a34b0", "status": "affected", "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "versionType": "git"}, {"lessThan": "05520e035f8332c8e33f3011b5ca016fde61793d", "status": "affected", "version": "bee33f22d7c30626e711b4900e3f460b6e0e104f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/clocksource/timer-nxp-pit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path\n\nWhen cpuhp_setup_state fails after pit_clockevent_per_cpu_init has\nsuccessfully called request_irq, the error handling jumps directly to\nout_pit_clocksource_unregister without freeing the registered IRQ.\n\nThis leaks the IRQ line and, since kfree(pit) follows, leaves a\ndangling pointer registered as the interrupt handler's dev_id,\npotentially leading to a use-after-free if the IRQ fires afterwards.\n\nFix it by calling pit_clockevent_per_cpu_exit to properly release the\nIRQ before falling through to the existing cleanup chain."}], "id": "CVE-2026-89769", "lastModified": "2026-09-11T20:20:08.240", "metrics": {}, "published": "2026-09-11T20:20:08.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Use-after-free due to IRQ leak in NXP PIT clocksource driver", "id": "2532161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532161"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's NXP PIT (Programmable Interrupt Timer) clocksource driver. When the CPU hotplug setup fails after an interrupt request (IRQ) has been successfully registered, the error handling does not properly free the IRQ. This oversight results in a leaked IRQ line and a dangling pointer, which could lead to a use-after-free vulnerability if the IRQ is subsequently triggered. A local attacker could potentially exploit this to cause system instability or execute arbitrary code."], "name": "CVE-2026-89769", "public_date": "2026-09-11T19:47:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89769\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89769\nhttps://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d\nhttps://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0\nhttps://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04"], "threat_severity": "Moderate"}

{}