CVE-2026-74687: watchdog: at91sam9_wdt: prevent timer rearm during teardown
In the Linux kernel, the following vulnerability has been resolved:
watchdog: at91sam9wdt: prevent timer rearm during teardown
at91ping() rearms the watchdog timer from its callback. timerdelete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt after it has been freed.
Use timershutdownsync() on both teardown paths. It waits for a running callback and rejects any attempt by the callback to rearm the timer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the fix in the kernel: in watchdog: at91sam9_wdt, use timer_shutdown_sync() on both teardown paths so the driver waits for any running callback, and make the at91_ping() callback refuse/reject rearming the watchdog timer during teardown to prevent timer rearm after devm-allocated at91wdt has been freed.
Linux kernel watchdog driver at91sam9_wdt (at91_ping) callback teardown synchronization using timer_shutdown_sync() = Use timer_shutdown_sync() on both teardown paths and reject any attempt by the callback to rearm the timer during teardown (via timer_delete()/watchdog timer shutdown coordination).