CVE-2026-74652: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
In the Linux kernel, the following vulnerability has been resolved:
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers.
Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the serial amba-pl011 driver, complete the RS485 stop without arming a timer; free the IRQ first, then cancel both RS485 hrtimers. Also cancel both timers in remove() for the suspend-then-unbind path where shutdown is not called.
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
Systems using the Linux kernel's AMBA PL011 serial driver with RS485 trigger timers should be prioritized, particularly where the serial device may be removed or unbound.
Are suspend and device unbind relevant to exposure?
Yes. The fix specifically covers a suspend-then-unbind path in which shutdown is not called, requiring timer cancellation during remove().
What lifecycle ordering does the fix change?
It frees the IRQ before cancelling both RS485 timers, because the IRQ handler can arm a timer. It also completes RS485 stop without arming another timer.