UBUNTU-CVE-2026-74687: High severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9wdt: prevent timer rearm during teardown at91ping() rearms the watchdog timer from its callback. timerdelete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt after it has been freed. Use timershutdownsync() on both teardown paths. It waits for a running callback and rejects any attempt by the callback to rearm the timer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the at91sam9_wdt driver, replace timer_delete() with timer_shutdown_sync() on both teardown paths so running callbacks are waited for and prevented from rearming the watchdog timer.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue is identified for Ubuntu kernel packages including linux, linux-fips, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants. Exploitation requires local access and low privileges.
When can the vulnerable condition occur?
It can occur during driver probe failure or removal of the at91sam9_wdt watchdog driver. A running watchdog timer callback can rearm itself while teardown frees its devm-allocated driver state, leaving the timer able to access freed memory.
What is the impact of successful exploitation?
The reported severity vector indicates high impact to confidentiality, integrity, and availability. The vulnerability is locally exploitable without user interaction, but requires low privileges.
What does the fix change?
The fix replaces timer deletion on both teardown paths with timer_shutdown_sync(). This waits for an active callback to finish and prevents that callback from rearming the timer during teardown.