What is the CVSS score of CVE-2026-89947?

CVE-2026-89947 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H.

Which versions of Linux Kernel are affected by CVE-2026-89947?

A defect in the Linux kernel clock driver for Amlogic Meson GXBB system-on-chip boards - including devices such as the WeTek Hub - can cause affected hardware to fault during boot, potentially…. A patch is available.

How to fix or mitigate CVE-2026-89947?

Within 24 hours, inventory any Amlogic GXBB-based devices (including WeTek Hub and similar set-top boxes or single-board systems) and record their running kernel versions, flagging any that fall in the affected ranges 5.4.292+, 5.10.236-5.10.269, 5.15.180-5.15.220, 6.1.134-6.1.187, 6.6.87-6.6.156, 6.12.23-6.12.109, 6.13.11-6.13.x, 6.14.2-6.14.x, or the 6.15 mainline series. Within 7 days, upgrade affected devices to the vendor-released fixed kernels 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, or 7.3-rc1, coordinating with the device vendor where firmware is supplied as a locked image, and validate that systems boot cleanly with no kernel global-out-of-bounds reports. Within 30 days, fold these kernel baselines into standard firmware patch-management and asset-tracking processes, confirm no unsupported or end-of-life GXBB devices remain in production without compensating physical controls, and re-scan to verify all units report a fixed version.

Linux Kernel CVE-2026-89947

EUVD-2026-80547 HIGH

2026-09-16 Linux

GHSA-8jgg-jgf5-2v4q

Buffer Overflow Linux

8.0

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.0 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

vuln.today AI

4.0 MEDIUM

Boot-time, self-triggered global over-read on specific hardware; no attacker input and data never reaches userspace, so C:N/I:N and at most a minor A:L from possible clock misconfiguration.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 16:07 vuln.today

CVSS changed

Sep 16, 2026 - 15:22 NVD

8.0 (HIGH)

Patch available

Sep 16, 2026 - 11:03 EUVD

CVE Published

Sep 16, 2026 - 10:32 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 16, 2026 - 10:32 cve.org

HIGH 8.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

clk: meson: align gxbb_32k_clk_sel number of parents with actual count

The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ============== BUG: KASAN: global-out-of-bounds in __clk_register+0x1b70/0x2418 Read of size 8 at addr ffffd66320cf88e0 by task swapper/0/1

CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc5 #1 PREEMPT Hardware name: WeTek Hub (DT) Call trace: show_stack+0x14/0x20 (C) dump_stack_lvl+0x74/0x94 print_report+0x164/0x4b0 kasan_report+0x98/0xd8 __asan_report_load8_noabort+0x1c/0x24 __clk_register+0x1b70/0x2418 devm_clk_hw_register+0x74/0x15c meson_clkc_init+0xd4/0x20c meson_clkc_syscon_probe+0x5c/0x94 platform_probe+0xbc/0x17c really_probe+0x184/0x844 __driver_probe_device+0x154/0x35c driver_probe_device+0x60/0x188 __driver_attach+0x168/0x4a0 bus_for_each_dev+0xec/0x180 driver_attach+0x38/0x58 bus_add_driver+0x238/0x4c0 driver_register+0x150/0x388 __platform_driver_register+0x54/0x7c gxbb_clkc_driver_init+0x18/0x20 do_one_initcall+0xb8/0x340 kernel_init_freeable+0x49c/0x52c kernel_init+0x24/0x148 ret_from_fork+0x10/0x20

The buggy address belongs to the variable: gxbb_32k_clk_parents+0x60/0x400

The buggy address belongs to a vmalloc virtual mapping The buggy address belongs to the physical page:

Memory state around the buggy address: ffffd66320cf8780: 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ffffd66320cf8800: 00 04 f9 f9 f9 f9 f9 f9 00 04 f9 f9 f9 f9 f9 f9 >ffffd66320cf8880: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 ^ ffffd66320cf8900: 00 01 f9 f9 f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9 ffffd66320cf8980: 00 00 02 f9 f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9 ==============

Commit 7915d7d5407c ("clk: amlogic: gxbb: drop non existing 32k clock parent") dropped a non-existing clock parent from the gxbb_32k_clk_sel mux but didn't adjust the hard-coded num_parents field. Fix the actual number of parents of that mux by using ARRAY_SIZE instead (avoiding similar problems in future).

AnalysisAI

An out-of-bounds read in the Amlogic Meson GXBB clock controller driver causes a kernel global-out-of-bounds report (KASAN: read of size 8 in gxbb_32k_clk_parents) during clock registration at boot on GXBB-based boards such as the WeTek Hub. The defect comes from a mux parent count that was left hard-coded after a stale parent entry was removed, so the driver walks one slot past the end of its parent array; affected code shipped in stable kernels including 5.4.292+, 5.10.236-5.10.269, 5.15.180-5.15.220, 6.1.134-6.1.187, 6.6.87-6.6.156, 6.12.23-6.12.109, 6.13.11-6.13.x, 6.14.2-6.14.x and the 6.15 mainline series, and is fixed in newer stable releases (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, 7.3-rc1). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires running an affected Linux kernel version on Amlogic Meson GXBB hardware (e.g., WeTek Hub, S905-based boards) where the gxbb clock controller driver (CONFIG for meson/gxbb clk) probes at boot. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Vendor CVSS is 8.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), but this is substantially over-scored relative to the actual defect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patches are available: rebase to a kernel carrying the fix at 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1 (upstream commits 628b6fee9fca292f12d07f0f1bcf1edefa949d81 and its stable backports, linked at https://git.kernel.org/stable/c/628b6fee9fca292f12d07f0f1bcf1edefa949d81, https://git.kernel.org/stable/c/bf85bd6e550c17ffa585606fcc18eb5b7c95bbce, https://git.kernel.org/stable/c/4582949b7badcb91bb537ca522d69b8a35131e72, https://git.kernel.org/stable/c/404079d124d75a5da16322acc53d3ffc50b4ec68, https://git.kernel.org/stable/c/f6ff0e6995dbff5cb145d7795c8f0af9c168094a, https://git.kernel.org/stable/c/1e509a6707d2fd9da79bdfa24742661b34562bfd, https://git.kernel.org/stable/c/8b2f7a411e7ceaef268355c2150c22ee3f509c3b and https://git.kernel.org/stable/c/c86214e6178c38a0eff39110a4e92b824f5dd403), which simply replaces the hard-coded mux parent count with ARRAY_SIZE. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory any Amlogic GXBB-based devices (including WeTek Hub and similar set-top boxes or single-board systems) and record their running kernel versions, flagging any that fall in the affected ranges 5.4.292+, 5.10.236-5.10.269, 5.15.180-5.15.220, 6.1.134-6.1.187, 6.6.87-6.6.156, 6.12.23-6.12.109, 6.13.11-6.13.x, 6.14.2-6.14.x, or the 6.15 mainline series. …

Threat intelligence, references, and detailed analysis are available after sign-in.