{"id":"CVE-2026-99189","kind":"vulnerability","aliases":["CVE-2026-99189"],"related":[],"title":"Linux kernel GPIO driver: interrupt race during probe can crash the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mxc: fix race between chained IRQ handler install and probe completion\n\nmxc_update_irq_chained_handler() is called before the IRQ domain, the\ngeneric IRQ chip, and the port list entry are set up. If an interrupt\narrives in that window:\n\n - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with\n   port->domain still NULL.\n - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not\n   been added to the list yet.\n\nAdditionally, if any of the subsequent probe steps\n(gpio_generic_chip_init(), devm_gpiochip_add_data(),\nirq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error\npaths never unregister the chained handler, leaving a dangling handler\nthat points at freed memory.\n\nMove the handler installation after all its dependencies are ready and\nafter list_add_tail(), so the handler is never live while the data\nstructures it touches are incomplete, and is never installed if probe\nfails.","summary":"The MXC GPIO driver installs its chained interrupt handler before the IRQ domain and port list are ready, so an interrupt arriving during probe can dereference a NULL domain or walk incomplete state. A failed probe also leaves the handler registered, pointing at freed memory, which can cause a crash or memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","imx","linux-kernel","other"],"not_affected_if":["no-imx-soc","x86-server"],"how_to_check":"- `uname -r` to get the running kernel version\n- unknown whether the sources list affected kernel version ranges\n- check whether the system uses the MXC (i.MX) GPIO driver, for example `grep -i mxc /proc/interrupts` or `dmesg | grep -i gpio`","fix":"- Update to a Linux kernel release that includes the upstream commit fixing gpio: mxc race between chained IRQ handler install and probe completion\n- unknown exact fixed version from the sources","status":"open","published_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:34:17+00:00","updated_at":"2026-10-28T11:34:17+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-28T11:34:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing gpio: mxc race between chained IRQ handler install and probe completion\n- unknown exact fixed version from the sources","reach":"local","title":"Linux kernel GPIO driver: interrupt race during probe can crash the kernel","impact":"medium","summary":"The MXC GPIO driver installs its chained interrupt handler before the IRQ domain and port list are ready, so an interrupt arriving during probe can dereference a NULL domain or walk incomplete state. A failed probe also leaves the handler registered, pointing at freed memory, which can cause a crash or memory corruption.","category":"other","nicknames":[],"who_cares":["linux-kernel","embedded","imx"],"confidence":0.4,"needs_auth":"no","worst_case":"kernel crash or memory corruption from a dangling interrupt handler","analyst_note":"Sources give no CVSS, affected kernel ranges or fixed commit; check the NVD entry and the kernel stable git log for the fixing commit and version.","how_to_check":"- `uname -r` to get the running kernel version\n- unknown whether the sources list affected kernel version ranges\n- check whether the system uses the MXC (i.MX) GPIO driver, for example `grep -i mxc /proc/interrupts` or `dmesg | grep -i gpio`","needs_analyst":true,"not_affected_if":["no-imx-soc","x86-server"],"who_is_affected":"Systems running a Linux kernel with the Freescale/NXP i.MX GPIO (MXC) driver, typically embedded or ARM boards using i.MX SoCs. Desktop and server systems without i.MX GPIO hardware are unlikely to load this driver. The race needs an interrupt during probe or a probe failure, so ordinary running systems are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":3589,"output_tokens":672,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99189':15A,18A 'add':157C,176C,218C 'addit':162C 'also':60B 'arriv':45B,125C 'call':105C,133C 'caus':71B 'chain':30B,92C,102C,194C 'chip':113C,172C 'complet':98C 'corrupt':76B 'crash':10A,73B 'creat':180C 'cve':13A,16A 'dangl':198C 'data':177C,228C 'depend':212C 'derefer':49B 'devm':174C 'domain':36B,52B,109C,136C,140C,179C 'driver':4A,27B 'embed':19B 'entri':118C 'error':189C 'fail':58B,187C,240C 'fix':89C 'follow':82C 'freed':67B,203C 'gc':186C 'generic':111C,134C,171C 'gpio':3A,26B,87C,130C,144C,149C,170C,184C 'gpiochip':175C 'handl':135C 'handler':32B,63B,94C,103C,132C,146C,195C,199C,207C,222C 'imx':20B 'incomplet':55B,233C 'init':173C,185C 'instal':28B,95C,208C,237C 'interrupt':5A,31B,44B,124C 'irq':35B,93C,101C,108C,112C,131C,137C,145C,178C 'kernel':2A,12A,23B,80C 'leav':61B,196C 'legaci':181C 'linux':1A,22B,79C 'linux-kernel':21B 'list':39B,117C,160C,217C 'live':225C 'memori':68B,75B,204C 'move':205C 'mx2':143C 'mx3':129C 'mxc':25B,88C,99C,148C,183C 'never':191C,224C,236C 'null':51B,142C 'path':190C 'point':65B,201C 'port':38B,116C,139C,150C,153C 'probe':8A,47B,59B,97C,168C,239C 'race':6A,90C 'readi':41B,214C 'regist':64B 'resolv':86C 'set':120C 'state':56B 'step':169C 'still':141C 'structur':229C 'subsequ':167C 'tail':219C 'touch':231C 'unregist':192C 'updat':100C 'vulner':83C 'walk':54B,147C 'window':128C 'yet':161C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Freescale/NXP i.MX GPIO (MXC) driver, typically embedded or ARM boards using i.MX SoCs. Desktop and server systems without i.MX GPIO hardware are unlikely to load this driver. The race needs an interrupt during probe or a probe failure, so ordinary running systems are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99189","severity":null,"published_at":"2026-10-28T11:17:39+00:00","modified_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}