CVE-2026-74733: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
In the Linux kernel, the following vulnerability has been resolved:
gpio: pca953x: fix pca953xirqbussyncunlock regmap lock
Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2clock. The function pca953xirqbussyncunlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written.
A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using the pca953x GPIO driver are the relevant affected population. The issue concerns concurrent access through that driver's interrupt synchronization path.
What condition is needed to trigger the race?
Multiple threads must access regmap operations while pca953x_irq_bus_sync_unlock() runs without holding the driver's i2c_lock. This can result in an incorrect register being read or written, including an unprotected read of the direction register.
Was the earlier locking fix sufficient?
No. The earlier change protected the interrupt-mask register write, but did not protect the direction-register read.