{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74461", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.901Z", "datePublished": "2026-08-15T12:27:01.924Z", "dateUpdated": "2026-08-19T16:37:00.344Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:37:00.344Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Cancel hrtimer before clearing slave pointer\n\nIn i2c_imx_unreg_slave(), the slave pointer is set to NULL after\ndisabling interrupts. However, a pending interrupt might already\nhave started the hrtimer (i2c_imx_slave_timeout) before the pointer\nwas cleared. If the hrtimer fires after i2c_imx->slave is set to\nNULL, the timer callback i2c_imx_slave_finish_op() will call\ni2c_imx_slave_event() with a NULL slave pointer, which results in a\nuse-after-free / NULL pointer dereference.\n\nFix by canceling the hrtimer and waiting for it to complete after\ndisabling interrupts, before clearing the slave pointer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the imx I2C slave teardown path reached via i2c_slave_unregister during local driver removal on embedded i.MX systems; exploitation requires local proximity to trigger concurrent I2C bus activity on the same controller.\nAC:L - The attacker controls both sides of the race by generating I2C slave traffic to arm/restart the 30us hrtimer while unregister runs, and can retry rapidly across repeated teardown cycles until the window is hit.\nPR:N - No Linux credentials are required when an attacker with physical access to an exposed I2C bus races automated system maintenance (OTA, service restart, driver reload) that calls i2c_slave_unregister on imx slave backends.\nUI:N - Exploitation does not require victim interaction; automated firmware updates or service restarts that unregister the slave driver are sufficient to create the teardown side of the race.\nS:U - Impact is confined to kernel memory corruption and crash on the same host; this is not a VM escape, IOMMU bypass, or cross-security-authority boundary.\nC:H - The timer callback invokes i2c_slave_event with a NULL/freed slave pointer (use-after-free), a memory safety violation that can be leveraged for arbitrary kernel memory read primitives per CVSS UAF guidance.\nI:H - Use-after-free in the slave event callback path can enable heap manipulation and arbitrary kernel write or control-flow hijack, not merely a deterministic NULL dereference crash.\nA:H - Triggering i2c_slave_event with a NULL slave causes kernel oops/panic, and the original patch series notes the last_slave_event loop in i2c_imx_slave_finish_op can hang the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "versions": [{"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "e3da77bdb4015051656bb472c295656bbea03b6f", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "470fe15fb3bb2eba6629be301ca7e991ee3cfb7e", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "a8a1f9ac3d763e721586f15479ef9140b216ddf3", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "753060f2b77ff2f386addbd3ecadb95b9f90cddd", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "affd62f5719a78135b7441aa49c8cab3c3b5e838", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "dab4762ee7f3fd0a01980d5407ba48d0261d3bff", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e3da77bdb4015051656bb472c295656bbea03b6f"}, {"url": "https://git.kernel.org/stable/c/470fe15fb3bb2eba6629be301ca7e991ee3cfb7e"}, {"url": "https://git.kernel.org/stable/c/a8a1f9ac3d763e721586f15479ef9140b216ddf3"}, {"url": "https://git.kernel.org/stable/c/753060f2b77ff2f386addbd3ecadb95b9f90cddd"}, {"url": "https://git.kernel.org/stable/c/affd62f5719a78135b7441aa49c8cab3c3b5e838"}, {"url": "https://git.kernel.org/stable/c/dab4762ee7f3fd0a01980d5407ba48d0261d3bff"}, {"url": "https://git.kernel.org/stable/c/6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f"}], "title": "i2c: imx: Cancel hrtimer before clearing slave pointer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e3da77bdb4015051656bb472c295656bbea03b6f", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "470fe15fb3bb2eba6629be301ca7e991ee3cfb7e", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "a8a1f9ac3d763e721586f15479ef9140b216ddf3", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "753060f2b77ff2f386addbd3ecadb95b9f90cddd", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "affd62f5719a78135b7441aa49c8cab3c3b5e838", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "dab4762ee7f3fd0a01980d5407ba48d0261d3bff", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Cancel hrtimer before clearing slave pointer\n\nIn i2c_imx_unreg_slave(), the slave pointer is set to NULL after\ndisabling interrupts. However, a pending interrupt might already\nhave started the hrtimer (i2c_imx_slave_timeout) before the pointer\nwas cleared. If the hrtimer fires after i2c_imx->slave is set to\nNULL, the timer callback i2c_imx_slave_finish_op() will call\ni2c_imx_slave_event() with a NULL slave pointer, which results in a\nuse-after-free / NULL pointer dereference.\n\nFix by canceling the hrtimer and waiting for it to complete after\ndisabling interrupts, before clearing the slave pointer."}], "id": "CVE-2026-74461", "lastModified": "2026-08-19T17:21:03.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:17:50.763", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/470fe15fb3bb2eba6629be301ca7e991ee3cfb7e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/753060f2b77ff2f386addbd3ecadb95b9f90cddd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8a1f9ac3d763e721586f15479ef9140b216ddf3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/affd62f5719a78135b7441aa49c8cab3c3b5e838"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dab4762ee7f3fd0a01980d5407ba48d0261d3bff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3da77bdb4015051656bb472c295656bbea03b6f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: i2c: imx: Cancel hrtimer before clearing slave pointer", "id": "2517071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517071"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ni2c: imx: Cancel hrtimer before clearing slave pointer\nIn i2c_imx_unreg_slave(), the slave pointer is set to NULL after\ndisabling interrupts. However, a pending interrupt might already\nhave started the hrtimer (i2c_imx_slave_timeout) before the pointer\nwas cleared. If the hrtimer fires after i2c_imx->slave is set to\nNULL, the timer callback i2c_imx_slave_finish_op() will call\ni2c_imx_slave_event() with a NULL slave pointer, which results in a\nuse-after-free / NULL pointer dereference.\nFix by canceling the hrtimer and waiting for it to complete after\ndisabling interrupts, before clearing the slave pointer.", "A flaw was found in the Linux kernel, specifically within the i2c: imx driver. This vulnerability occurs due to a timing issue during device unregistration, where a critical pointer is cleared before a related timer is properly canceled. If a pending interrupt triggers the timer after the pointer is cleared, it results in a NULL pointer dereference. This can lead to a system crash, potentially allowing a local attacker to cause a denial of service."], "name": "CVE-2026-74461", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74461\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74461\nhttps://lore.kernel.org/linux-cve-announce/2026081532-CVE-2026-74461-5a10@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,a8a1f9ac3d763e721586f15479ef9140b216ddf3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,753060f2b77ff2f386addbd3ecadb95b9f90cddd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,affd62f5719a78135b7441aa49c8cab3c3b5e838)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,dab4762ee7f3fd0a01980d5407ba48d0261d3bff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:30:10.512762+00:00", "updated": "2026-08-17T15:15:04.346257+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-476"]}