CVE-2026-74687: watchdog: at91sam9_wdt: prevent timer rearm during teardown
In the Linux kernel, the following vulnerability has been resolved:
watchdog: at91sam9wdt: prevent timer rearm during teardown
at91ping() rearms the watchdog timer from its callback. timerdelete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt after it has been freed.
Use timershutdownsync() on both teardown paths. It waits for a running callback and rejects any attempt by the callback to rearm the timer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.45 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In the at91sam9_wdt driver, replace timer_delete() with timer_shutdown_sync() on both teardown paths so teardown waits for running callbacks and prevents at91_ping() from rearming the watchdog timer.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel at91sam9_wdt watchdog driver are affected. The unsafe condition can occur during driver probe failure or driver removal, when the watchdog timer callback may still be running.
What condition triggers the vulnerability?
The timer callback must race with teardown: at91_ping() can rearm the watchdog timer while the driver is being removed or while probe cleanup is running. This can leave a rearmed timer referencing devm-allocated driver data after that data has been freed.
What mitigation is available if an updated kernel cannot be deployed immediately?
The provided data identifies the affected teardown paths as driver removal and probe failure cleanup. Avoiding removal of the at91sam9_wdt driver limits exposure to the removal path, but no complete workaround for probe-failure cleanup is specified.
How is the issue fixed?
The fix replaces teardown handling with timer_shutdown_sync() on both teardown paths. This waits for an active callback to finish and prevents that callback from rearming the timer.