CVE-2026-74461: i2c: imx: Cancel hrtimer before clearing slave pointer
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: Cancel hrtimer before clearing slave pointer
In i2cimxunregslave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2cimxslavetimeout) before the pointer was cleared. If the hrtimer fires after i2cimx->slave is set to NULL, the timer callback i2cimxslavefinishop() will call i2cimxslaveevent() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.
Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74461?
The severity of CVE-2026-74461 is rated at 38.
How do I fix CVE-2026-74461?
To fix CVE-2026-74461, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What components are affected by CVE-2026-74461?
CVE-2026-74461 affects the I2C subsystem specifically related to the imx device drivers in the Linux kernel.
What types of vulnerabilities are present in CVE-2026-74461?
CVE-2026-74461 involves Use After Free and Null Pointer Dereference vulnerabilities.
When was CVE-2026-74461 published?
CVE-2026-74461 was published on August 15, 2026.