CVE-2026-74461

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-74461

Key Details

CVE	CVE-2026-74461
CVSS Score / Version	8.4 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Cancel hrtimer before clearing slave pointer

In i2c_imx_unreg_slave(), the slave pointer is set to NULL after

disabling interrupts. However, a pending interrupt might already

have started the hrtimer (i2c_imx_slave_timeout) before the pointer

was cleared. If the hrtimer fires after i2c_imx->slave is set to

NULL, the timer callback i2c_imx_slave_finish_op() will call

i2c_imx_slave_event() with a NULL slave pointer, which results in a

use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after

disabling interrupts, before clearing the slave pointer. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-74461
CVE	https://www.cve.org/CVERecord?id=CVE-2026-74461

Source

Reference

NVD

CVE