Junglewise Threat Intelligence

CVE-2026-89947: Linux kernel clock meson global out-of-bounds read

CVE-2026-89947 · Severity: high · CVSS 8 · Published 2026-09-16

Executive brief

A flaw in the Linux kernel's Amlogic clock management code causes an out-of-bounds memory read during clock initialization on certain devices. An attacker with physical access or local code execution capability could trigger a kernel crash or information leak by exploiting this memory safety violation.

Technical details

A global-out-of-bounds read vulnerability (CWE-125) exists in the Linux kernel's Amlogic clock subsystem (clk: meson). The gxbb_32k_clk_sel clock mux's num_parents field was hard-coded but not updated when a non-existent clock parent was dropped in commit 7915d7d5407c, causing the kernel to read beyond the bounds of the gxbb_32k_clk_parents array during clock registration. The vulnerability is triggered during kernel initialization on affected WeTek Hub devices when __clk_register() attempts to access parent clock references. Exploitation occurs at boot time, making it difficult for typical user-space attackers to trigger; however, the memory disclosure could leak kernel information or cause a denial-of-service through panic. The fix involves using ARRAY_SIZE() instead of a hard-coded value to ensure num_parents matches the actual parent array size.

Affected products

  • Linux Linux kernel 5.10 through 7.0 (approximately; versions with gxbb clock driver)

Timeline

  • 2026-09-16: disclosed

Related threats