CVE-2026-89769

The Linux kernel's NXP PIT (Periodic Interrupt Timer) clocksource driver fails to clean up correctly when driver initialization partially fails: if pit_clockevent_per_cpu_init successfully calls request_irq but the subsequent cpuhp_setup_state fails, the error path jumps directly to clocksource unregistration and kfree(pit) without releasing the IRQ. This leaves the IRQ line leaked and a dangling pointer registered as the interrupt handler's dev_id, so if that IRQ fires afterwards the kernel performs a use-after-free, rated CVSS 3.1 7.4 (AV:L/AC:H) with high impact on confidentiality, integrity and availability for a local attacker. Affected systems are devices running vulnerable kernels on NXP SoCs whose timer block is managed by the nxp-pit driver, such as Vybrid-class parts historically served by this driver in embedded boards. Exploitation is unlikely in practice because it requires the rarely-hit cpuhp_setup_state failure path during boot/probe as well as local access, and no public proof-of-concept exists. The flaw is not on the CISA KEV list and there is no evidence of in-the-wild exploitation.

What to do: Apply kernel or SoC-vendor BSP updates that include the nxp-pit fix, which calls pit_clockevent_per_cpu_exit to release the IRQ before the existing cleanup chain. Teams maintaining NXP-based boards should backport this small patch. Practical risk is low because triggering requires the rarely-hit cpuhp_setup_state failure path during initialization, but the fix is cheap to take in the next maintenance cycle.