---
id: CVE-2026-89769
title: 'clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

  When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has
  successfully called reques…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bee33f22d7c30626e711b4900e3f460b6e0e104f <
    d53c29a89a15e56a1797f3ef249955e544782e04
  - >-
    Linux >= bee33f22d7c30626e711b4900e3f460b6e0e104f <
    cdcd861123248e871c2ec2be968b0a1b2a5a34b0
  - >-
    Linux >= bee33f22d7c30626e711b4900e3f460b6e0e104f <
    05520e035f8332c8e33f3011b5ca016fde61793d
  - Linux 6.18
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:52:22.773Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89769'
references:
  - url: 'https://git.kernel.org/stable/c/d53c29a89a15e56a1797f3ef249955e544782e04'
  - url: 'https://git.kernel.org/stable/c/cdcd861123248e871c2ec2be968b0a1b2a5a34b0'
  - url: 'https://git.kernel.org/stable/c/05520e035f8332c8e33f3011b5ca016fde61793d'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89769.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89769'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532161'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89769'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89769'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89769.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00166
epssPercentile: 0.0584
scores:
  cna: 7.4
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.472Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has
successfully called request_irq, the error handling jumps directly to
out_pit_clocksource_unregister without freeing the registered IRQ.

This leaks the IRQ line and, since kfree(pit) follows, leaves a
dangling pointer registered as the interrupt handler's dev_id,
potentially leading to a use-after-free if the IRQ fires afterwards.

Fix it by calling pit_clockevent_per_cpu_exit to properly release the
IRQ before falling through to the existing cleanup chain.

## Affected

- `Linux >= bee33f22d7c30626e711b4900e3f460b6e0e104f < d53c29a89a15e56a1797f3ef249955e544782e04`
- `Linux >= bee33f22d7c30626e711b4900e3f460b6e0e104f < cdcd861123248e871c2ec2be968b0a1b2a5a34b0`
- `Linux >= bee33f22d7c30626e711b4900e3f460b6e0e104f < 05520e035f8332c8e33f3011b5ca016fde61793d`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89769.json)