Executive brief
The NXP PIT (Periodic Interrupt Timer) driver in the Linux kernel contains a resource leak in its error handling path. When the CPU hotplug state initialization fails after successfully registering an interrupt handler, the driver fails to clean up the IRQ, leaving it dangling and potentially allowing a freed memory area to be accessed if the interrupt fires afterwards. This could lead to kernel crashes or undefined behavior on systems using NXP automotive hardware.
Technical details
The vulnerability is a resource leak combined with a use-after-free condition in the NXP PIT driver's pit_timer_init function. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init successfully calls request_irq, the error path jumps directly to cleanup without freeing the IRQ via pit_clockevent_per_cpu_exit. This leaves the IRQ handler's dev_id pointing to a freed pit data structure (freed by kfree(pit) in the cleanup path), creating a dangling pointer. If an interrupt fires on the leaked IRQ line after memory is reclaimed, a use-after-free occurs. The fix adds an explicit call to pit_clockevent_per_cpu_exit before the existing cleanup path to properly release the IRQ handler.
Affected products
- Linux Linux Kernel Versions with NXP Automotive s32g2/s32g3 support (introduced in commit bee33f22d7c3)
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-06-28: patched: Patch authored and committed upstream
- 2026-08-13: patched: Merged into mainline
- 2026-09-07: patched: Backported to stable series