CVE-2026-74461

HighCVSS 8.4/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Cancel hrtimer before clearing slave pointer

In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx->slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= f7414cd6923fd7f78e57086fc964ba2dc25db5c1, < e3da77bdb4015051656bb472c295656bbea03b6f; >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1, < 470fe15fb3bb2eba6629be301ca7e991ee3cfb7e; >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1, < a8a1f9ac3d763e721586f15479ef9140b216ddf3; >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1, < 753060f2b77ff2f386addbd3ecadb95b9f90cddd; >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1, < affd62f5719a78135b7441aa49c8cab3c3b5e838; >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1, < dab4762ee7f3fd0a01980d5407ba48d0261d3bff; >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1, < 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f
LinuxLinux5.11

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-74462In the Linux kernel, the following vulnerability has been resolved: i2c: imx: mark I2C adapter when hardware is powered down On some i.MX CVE-2026-74463In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lockCVE-2026-74464In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovCVE-2026-744657.8In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaCVE-2026-74466In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value iCVE-2026-744677.8In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP_NET_ADMIN for private ioctls Gate the SIOCDEVPRIVCVE-2026-74468In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use raw_spinlock_t for the register lock pch_irq_type() is CVE-2026-744698.8In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() incrCVE-2026-74476.3A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/updCVE-2026-744707.8In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_CVE-2026-744717.8In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_eCVE-2026-74472In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() ublk_c
CVE-2026-74461: High severity, CVSS 8.4 | Vulnix