Use-After-Free Vulnerability in Linux Kernel’s IRQ Handling

CVE-2026-89769

What is CVE-2026-89769?

A use-after-free vulnerability has been identified in the Linux kernel related to IRQ handling. Specifically, when the cpuhp_setup_state function encounters a failure after successfully calling request_irq within the pit_clockevent_per_cpu_init function, there is a risk of leaking the IRQ line. This occurs because the error handling process bypasses the necessary cleanup steps, resulting in a dangling pointer being registered as the interrupt handler's dev_id. If the IRQ is triggered after this failure, it could lead to a use-after-free condition, potentially compromising system stability and security. The issue has been addressed by ensuring that the pit_clockevent_per_cpu_exit function is called to properly release the IRQ before proceeding with the cleanup process.

References