EUVD-2026-76681
GHSA-8vp9-2h56-3438
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local driver error path requires hardware presence and admin-level hotplug control; UAF primarily causes crash (A:H) with limited memory exposure.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has successfully called request_irq, the error handling jumps directly to out_pit_clocksource_unregister without freeing the registered IRQ.
This leaks the IRQ line and, since kfree(pit) follows, leaves a dangling pointer registered as the interrupt handler's dev_id, potentially leading to a use-after-free if the IRQ fires afterwards.
Fix it by calling pit_clockevent_per_cpu_exit to properly release the IRQ before falling through to the existing cleanup chain.
AnalysisAI
IRQ resource leak and potential use-after-free in the Linux kernel's NXP PIT (Periodic Interrupt Timer) clocksource driver allows a kernel crash if an interrupt fires after error-path cleanup. The driver's pit_clockevent_init() error path skips free_irq() when cpuhp_setup_state() fails after request_irq() has already succeeded, then proceeds to kfree(pit), leaving the registered IRQ handler's dev_id pointing to freed slab memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires: (1) NXP SoC hardware with the PIT timer (i.MX or Layerscape families) running a Linux kernel in the affected commit range; (2) a failure of cpuhp_setup_state() during driver initialization or CPU hotplug - this is an uncommon error condition requiring either resource exhaustion, memory pressure, or a hardware/firmware fault; (3) the PIT IRQ must fire after kfree(pit) but before the IRQ is eventually cleaned up, introducing a timing race. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Linux kernel to a patched release: 7.2.4, 6.18.50, or 7.3-rc1 (mainline). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running Linux with NXP PIT clocksource driver (check /sys/devices/system/clocksource/clocksource0/current_clocksource for 'pit' on NXP i.MX hardware). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today