CVE-2026-74733: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
gpio: pca953x: fix pca953xirqbussyncunlock regmap lock
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9 - Compensating control
In the Linux kernel gpio pca953x driver, ensure every regmap read and write, including the read from the direction register and the write to the interrupt mask register, holds the i2c_lock.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using the pca953x GPIO driver are the relevant affected population. The issue concerns concurrent access through that driver's interrupt synchronization path.
What condition is needed to trigger the race?
Multiple threads must access regmap operations while pca953x_irq_bus_sync_unlock() runs without holding the driver's i2c_lock. This can result in an incorrect register being read or written, including an unprotected read of the direction register.
Was the earlier locking fix sufficient?
No. The earlier change protected the interrupt-mask register write, but did not protect the direction-register read.