CVE-2026-74461 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: Cancel hrtimer before clearing slave pointer
In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx->slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.
Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the Linux kernel's I2C driver implementation, specifically affecting the imx I2C controller driver. The issue stems from a race condition in the slave device registration cleanup process where proper synchronization between interrupt handling and resource deallocation is lacking. The vulnerability manifests when a slave device is unregistered while an interrupt handler might be in progress or queued, creating a dangerous timing window that can lead to critical system instability.
The technical flaw occurs in the i2c_imx_unreg_slave() function where the sequence of operations is fundamentally flawed. When the slave pointer is set to NULL after disabling interrupts, there exists a temporal gap during which a pending interrupt could execute and trigger the hrtimer callback function i2c_imx_slave_finish_op(). This callback function then attempts to invoke i2c_imx_slave_event() with a NULL slave pointer parameter, resulting in a classic use-after-free condition or null pointer dereference that can crash the kernel or potentially enable privilege escalation attacks.
The operational impact of this vulnerability is severe as it represents a kernel-level memory corruption issue that can lead to system crashes, data loss, or in worst-case scenarios, unauthorized access to privileged system resources. The vulnerability affects systems running Linux kernels with the imx I2C driver implementation, particularly embedded devices and industrial systems that rely on I2C slave communications for hardware control and sensor data collection. This issue directly violates security principles outlined in CWE-415 which addresses double free errors and CWE-476 which covers null pointer dereferences.
The fix implemented addresses the root cause by ensuring proper synchronization between interrupt handling and resource cleanup operations. By canceling the hrtimer and waiting for it to complete before clearing the slave pointer, the vulnerability is resolved through proper race condition prevention mechanisms. This approach aligns with established security practices such as those described in the ATT&CK framework under T1068 which deals with exploit development techniques targeting kernel memory corruption vulnerabilities.
The mitigation strategy involves ensuring that all timer operations are properly synchronized with critical resource deallocation sequences, preventing the scenario where interrupt handlers can reference freed or cleared data structures. This fix demonstrates proper kernel programming practices for handling concurrent access patterns and reinforces the importance of careful consideration when implementing interrupt service routines and their interaction with shared data structures in kernel space environments.