CVE-2026-89769

Summary

In the Linux kernel, the following vulnerability has been resolved:

clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has successfully called request_irq, the error handling jumps directly to out_pit_clocksource_unregister without freeing the registered IRQ.

This leaks the IRQ line and, since kfree(pit) follows, leaves a dangling pointer registered as the interrupt handler's dev_id, potentially leading to a use-after-free if the IRQ fires afterwards.

Fix it by calling pit_clockevent_per_cpu_exit to properly release the IRQ before falling through to the existing cleanup chain.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxbee33f22d7c30626e711b4900e3f460b6e0e104f < d53c29a89a15e56a1797f3ef249955e544782e04affected
LinuxLinuxbee33f22d7c30626e711b4900e3f460b6e0e104f < cdcd861123248e871c2ec2be968b0a1b2a5a34b0affected
LinuxLinuxbee33f22d7c30626e711b4900e3f460b6e0e104f < 05520e035f8332c8e33f3011b5ca016fde61793daffected
LinuxLinux6.18affected
LinuxLinux0 < 6.18unaffected
LinuxLinux6.18.50 <= 6.18.*unaffected
LinuxLinux7.2.4 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References