CVE-2026-89947 Overview
CVE-2026-89947 is an out-of-bounds read vulnerability in the Linux kernel's Amlogic Meson GXBB clock controller driver. The flaw resides in the gxbb_32k_clk_sel mux, where the hard-coded num_parents field exceeds the actual size of the gxbb_32k_clk_parents array. When __clk_register iterates through the declared parent count, it reads past the array bounds. KASAN identified the issue on a GXBB WeTek Hub device during boot. The vulnerability affects local systems running vulnerable Linux kernel versions on Amlogic GXBB hardware.
Critical Impact
Local attackers or triggered code paths can cause out-of-bounds kernel memory reads during clock registration, potentially leading to information disclosure or kernel instability on affected Amlogic GXBB platforms.
Affected Products
- Linux kernel with Amlogic Meson GXBB clock controller driver enabled
- Devices based on the Amlogic S905 (GXBB) SoC, including WeTek Hub
- Kernel versions containing commit 7915d7d5407c prior to the fix
Discovery Timeline
- 2026-09-16 - CVE-2026-89947 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89947
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] in the Amlogic Meson GXBB clock controller. The gxbb_32k_clk_sel multiplexer clock declares a fixed parent count that no longer matches the actual number of entries in its parent array. When the Common Clock Framework invokes __clk_register, it iterates using the declared num_parents value and dereferences memory beyond the end of gxbb_32k_clk_parents.
KASAN reported a global-out-of-bounds read of size 8 during the meson_clkc_syscon_probe initialization path. The read occurs in kernel context under swapper/0 (PID 1) at boot, indicating the condition triggers deterministically during driver probe on affected hardware.
Root Cause
Commit 7915d7d5407c ("clk: amlogic: gxbb: drop non existing 32k clock parent") removed a non-existent clock parent from the gxbb_32k_clk_sel mux definition. The removal shrank the gxbb_32k_clk_parents array but left the hard-coded num_parents field unchanged. This mismatch causes clock registration logic to read one entry past the array's valid range. The fix replaces the hard-coded value with ARRAY_SIZE(gxbb_32k_clk_parents) to keep the count synchronized with the array.
Attack Vector
Exploitation requires local access to a system running an affected kernel on Amlogic GXBB hardware. The out-of-bounds read is triggered automatically during driver initialization at boot, so no attacker action is required to reach the vulnerable code path. The disclosed memory contents depend on adjacent global data layout in the kernel image. The vulnerability does not provide a direct write primitive, but repeated triggering or combination with other flaws could support information disclosure or kernel destabilization.
See the upstream fix in Kernel Git Commit 628b6fe and the related backports for technical details.
Detection Methods for CVE-2026-89947
Indicators of Compromise
- KASAN reports in dmesg referencing global-out-of-bounds in __clk_register with the buggy address belonging to gxbb_32k_clk_parents.
- Kernel boot logs showing call traces through meson_clkc_init, meson_clkc_syscon_probe, and devm_clk_hw_register on Amlogic GXBB devices.
- Unexpected kernel warnings or panics during platform driver probe on GXBB-based hardware.
Detection Strategies
- Enable CONFIG_KASAN on test kernels for Amlogic GXBB targets to surface out-of-bounds reads during clock subsystem initialization.
- Inventory devices using the meson-gxbb-clkc driver and correlate installed kernel versions against the fixed commits listed in the upstream references.
- Monitor centralized logging for kernel messages containing __clk_register KASAN reports on ARM64 Amlogic platforms.
Monitoring Recommendations
- Forward kernel ring buffer output from Amlogic-based edge and IoT devices to a central log store for review.
- Alert on new kernel oops, KASAN, or UBSAN reports originating from clock driver code paths.
- Track kernel package versions across the fleet to confirm patched builds are deployed on GXBB hardware.
How to Mitigate CVE-2026-89947
Immediate Actions Required
- Identify all systems running Amlogic GXBB SoCs with kernels containing commit 7915d7d5407c but lacking the fix.
- Schedule kernel updates to a stable release that includes one of the fixing commits referenced in the NVD entry.
- Restrict local access on affected devices until patched kernels are deployed.
Patch Information
The upstream fix replaces the hard-coded num_parents value with ARRAY_SIZE(gxbb_32k_clk_parents) so future array changes remain consistent. Fixes have been merged and backported across multiple stable branches. Reference commits include 1e509a6, 404079d, 4582949, 628b6fe, 8b2f7a4, bf85bd6, c86214e, and f6ff0e6.
Workarounds
- Where updating is not immediately feasible, disable the meson-gxbb-clkc driver on affected boards if the platform tolerates it.
- Limit console and physical access to affected embedded devices to reduce local exposure.
- Rebuild affected kernels with the upstream patch applied as an out-of-tree backport if a distribution update is not yet available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
