---
id: "CVE-2026-99189"
kind: "vulnerability"
aliases: ["CVE-2026-99189"]
title: "Linux kernel GPIO driver: interrupt race during probe can crash the kernel"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["embedded", "imx", "linux-kernel", "other"]
not_affected_if: ["no-imx-soc", "x86-server"]
published_at: "2026-10-28T11:17:39+00:00"
first_seen_at: "2026-10-28T11:32:37+00:00"
updated_at: "2026-10-28T11:34:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99189", "first_seen_at": "2026-10-28T11:32:37+00:00"}]
---

# Linux kernel GPIO driver: interrupt race during probe can crash the kernel

The MXC GPIO driver installs its chained interrupt handler before the IRQ domain and port list are ready, so an interrupt arriving during probe can dereference a NULL domain or walk incomplete state. A failed probe also leaves the handler registered, pointing at freed memory, which can cause a crash or memory corruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to get the running kernel version
- unknown whether the sources list affected kernel version ranges
- check whether the system uses the MXC (i.MX) GPIO driver, for example `grep -i mxc /proc/interrupts` or `dmesg | grep -i gpio`

## Fix

- Update to a Linux kernel release that includes the upstream commit fixing gpio: mxc race between chained IRQ handler install and probe completion
- unknown exact fixed version from the sources

## Timeline

- 2026-10-28T11:32:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99189

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

gpio: mxc: fix race between chained IRQ handler install and probe completion

mxc_update_irq_chained_handler() is called before the IRQ domain, the
generic IRQ chip, and the port list entry are set up. If an interrupt
arrives in that window:

 - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with
   port->domain still NULL.
 - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not
   been added to the list yet.

Additionally, if any of the subsequent probe steps
(gpio_generic_chip_init(), devm_gpiochip_add_data(),
irq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error
paths never unregister the chained handler, leaving a dangling handler
that points at freed memory.

Move the handler installation after all its dependencies are ready and
after list_add_tail(), so the handler is never live while the data
structures it touches are incomplete, and is never installed if probe
fails.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_