Live › vulnerability › CVE-2026-99189
Go to dashboardThe MXC GPIO driver installs its chained interrupt handler before the IRQ domain and port list are ready, so an interrupt arriving during probe can dereference a NULL domain or walk incomplete state. A failed probe also leaves the handler registered, pointing at freed memory, which can cause a crash or memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Freescale/NXP i.MX GPIO (MXC) driver, typically embedded or ARM boards using i.MX SoCs. Desktop and server systems without i.MX GPIO hardware are unlikely to load this driver. The race needs an interrupt during probe or a probe failure, so ordinary running systems are less exposed.
No product ranges from the sources yet.
uname -r to get the running kernel versiongrep -i mxc /proc/interrupts or dmesg | grep -i gpioEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
gpio: mxc: fix race between chained IRQ handler install and probe completion
mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window:
Additionally, if any of the subsequent probe steps (gpio_generic_chip_init(), devm_gpiochip_add_data(), irq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error paths never unregister the chained handler, leaving a dangling handler that points at freed memory.
Move the handler installation after all its dependencies are ready and after list_add_tail(), so the handler is never live while the data structures it touches are incomplete, and is never installed if probe fails.
This page as .md · .json · in your agent: get_signal("CVE-2026-99189")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.