CVE-2026-89769: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89769 Overview

CVE-2026-89769 is a Linux kernel vulnerability in the NXP Periodic Interrupt Timer (PIT) clocksource driver. The flaw resides in the error handling path of cpuhp_setup_state within the driver's initialization routine. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has already called request_irq, the cleanup path skips freeing the registered interrupt request (IRQ). The subsequent kfree(pit) then leaves a dangling pointer registered as the interrupt handler's dev_id. If the IRQ fires afterward, the kernel dereferences freed memory, creating a use-after-free condition on freed kernel heap memory.

Critical Impact
Local use-after-free in the Linux kernel nxp-pit clocksource driver that can compromise kernel memory integrity and availability on affected NXP-based systems.

Affected Products

Linux kernel versions containing the clocksource/drivers/nxp-pit driver prior to the fix
NXP-based platforms (typically i.MX-family SoCs) that instantiate the PIT clocksource
Downstream distributions shipping the affected nxp-pit driver

Discovery Timeline

2026-09-11 - CVE-2026-89769 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89769

Vulnerability Analysis

The vulnerability is a use-after-free triggered through improper error-path cleanup in the nxp-pit clocksource driver. During probe, pit_clockevent_per_cpu_init registers an interrupt handler via request_irq, passing the pit structure as dev_id. If the subsequent cpuhp_setup_state call fails, control jumps directly to the out_pit_clocksource_unregister label. That label unregisters the clocksource and calls kfree(pit) but never invokes free_irq. The IRQ line remains registered against a now-freed dev_id pointer, and any subsequent interrupt causes the kernel to operate on freed memory. This can result in kernel memory corruption, information disclosure, or denial of service depending on heap reuse timing.

Root Cause

The root cause is a missing cleanup step in the driver's error-handling chain. The developer added request_irq earlier in the initialization sequence but did not extend the error path to call pit_clockevent_per_cpu_exit, which is responsible for releasing the IRQ. The result is an IRQ leak combined with a dangling dev_id pointer after kfree, which produces a classic use-after-free primitive tied to interrupt delivery.

Attack Vector

Exploitation requires local access to a system running an affected kernel on NXP hardware where the nxp-pit driver initialization path can be triggered to fail after request_irq succeeds. The attack complexity is high because the attacker must influence probe-time failure and race with interrupt delivery on freed memory. Successful exploitation impacts confidentiality, integrity, and availability of the kernel.

No public proof-of-concept code has been released for this issue. See the upstream commits for technical details of the fix: Kernel Git Commit 05520e0, Kernel Git Commit cdcd861, and Kernel Git Commit d53c29a.

Detection Methods for CVE-2026-89769

Indicators of Compromise

Kernel oops or panic messages referencing pit_clockevent, nxp-pit, or the interrupt handler with freed-slab addresses
KASAN use-after-free reports naming the pit allocation and the nxp-pit IRQ handler
Unexplained kernel crashes on NXP i.MX-class hardware shortly after boot or driver reload

Detection Strategies

Enable CONFIG_KASAN on test systems to surface the use-after-free during driver initialization failures
Compare running kernel versions and vendor BSP branches against the upstream fix commits to identify unpatched builds
Monitor dmesg for request_irq success followed by clocksource unregistration events without a matching free_irq

Monitoring Recommendations

Centralize kernel logs from NXP-based fleets and alert on BUG:, KASAN, and general protection fault entries referencing timer subsystems
Track kernel package versions across embedded and edge devices to detect regressions to vulnerable builds
Alert on repeated device probe failures for nxp-pit, which correlate with the vulnerable code path being exercised

How to Mitigate CVE-2026-89769

Immediate Actions Required

Apply the upstream fix that calls pit_clockevent_per_cpu_exit in the cpuhp_setup_state error path before freeing pit
Rebuild and deploy patched kernels to all NXP-based systems that load the nxp-pit driver
Restrict local access on affected devices until patched kernels are deployed

Patch Information

The fix is available in the following upstream commits: Kernel Git Commit 05520e0, Kernel Git Commit cdcd861, and Kernel Git Commit d53c29a. Consume the fix from your distribution's stable kernel updates or backport it into vendor Board Support Package (BSP) trees.

Workarounds

Disable the nxp-pit clocksource driver on platforms where an alternative timer source is available
Block untrusted local users from triggering module reloads or probe conditions that exercise the vulnerable path
Deploy kernels built with hardening options such as SLAB_FREELIST_HARDENED to raise exploitation cost until patches are applied

bash

# Verify running kernel against fixed commits
uname -r
zcat /proc/config.gz | grep -E 'NXP_PIT|CLKSRC'
# Blacklist the driver if an alternative clocksource is present
echo 'blacklist nxp-pit' | sudo tee /etc/modprobe.d/blacklist-nxp-pit.conf
sudo update-initramfs -u