CVE-2026-74733

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74733", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.930Z", "datePublished": "2026-08-22T15:33:21.579Z", "dateUpdated": "2026-10-30T12:30:25.982Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:30:25.982Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable pca953x_irq_bus_sync_unlock() path is reached only through local kernel interfaces\u2014GPIO chardev ioctls (GPIO_V2_GET_LINE_IOCTL, GPIO_V2_LINE_SET_CONFIG_IOCTL, GPIO_V2_LINE_SET_VALUES_IOCTL), legacy sysfs GPIO, or concurrent in-kernel GPIO/IRQ ops\u2014not via any network or physical bus-facing attack surface.\nAC:L - An attacker drives both racing sides directly: one thread loops IRQ edge-detection setup/teardown (request_irq \u2192 irq_bus_sync_unlock) while another hammers GPIO value/direction writes holding i2c_lock; the original report reproduced the race ~1 in 1000 boots, so deliberate concurrency wins reliably.\nPR:L - Exploitation requires an open file descriptor on /dev/gpiochipN or sysfs GPIO access; on embedded, industrial, medical, and automotive boards using pca953x expanders, udev routinely grants gpio group membership to unprivileged local users.\nUI:N - No victim interaction is required\u2014the attacker performs all GPIO ioctl and IRQ configuration steps in its own threads without needing another user to mount, open, or configure devices.\nS:U - Corruption is confined to the kernel and the same on-board I2C GPIO expander; it does not cross VM, container, IOMMU, or other security-boundary scopes into a different authority.\nC:H - With regmap disable_locking=true, the unprotected pca953x_read_regs() direction read races locked regmap paths, corrupting the maple regcache and returning data from the wrong register\u2014yielding kernel heap UAF read and unintended register-state disclosure.\nI:H - Racing regmap transactions write interrupt-latch/direction data into wrong expander registers (documented output-register corruption), arbitrarily toggling safety-critical GPIO outputs; concurrent unsynchronized regcache writes provide a heap corruption/write primitive.\nA:H - Concurrent regcache maple-tree corruption from unsynchronized regmap access can trigger kernel oops/panic via double-free; miswritten interrupt masks or direction registers can wedge expander IRQ handling and GPIO consumers in a persistent denial-of-service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "versions": [{"version": "58a5c93bd1a6e949267400080f07e57ffe05ec34", "lessThan": "58ed56c093a857c19f04cf3db1f02d2e793aec88", "status": "affected", "versionType": "git"}, {"version": "e2ecdddca80dd845df42376e4b0197fe97018ba2", "lessThan": "5d05c4252c09ce10624be2197853c80bf87424e4", "status": "affected", "versionType": "git"}, {"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "41255e64eb9dd87b0b8675f4e47a9c67bcef6e39", "status": "affected", "versionType": "git"}, {"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "bf3f37c2d40b51deb79aea910f28999d7c8c6b5a", "status": "affected", "versionType": "git"}, {"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090", "status": "affected", "versionType": "git"}, {"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "9dc325327babe7f159e84cbe9380a45342da0585", "status": "affected", "versionType": "git"}, {"version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41", "status": "affected", "versionType": "git"}, {"version": "6.1.101", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "6.6.42", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.9.11", "lessThan": "6.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.101", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.42", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/58ed56c093a857c19f04cf3db1f02d2e793aec88"}, {"url": "https://git.kernel.org/stable/c/5d05c4252c09ce10624be2197853c80bf87424e4"}, {"url": "https://git.kernel.org/stable/c/41255e64eb9dd87b0b8675f4e47a9c67bcef6e39"}, {"url": "https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a"}, {"url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"}, {"url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"}], "title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74733", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:15:53.820928Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:12.549Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74733", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:15:53.820928Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:15:54.570Z"}}], "cna": {"title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable pca953x_irq_bus_sync_unlock() path is reached only through local kernel interfaces\u2014GPIO chardev ioctls (GPIO_V2_GET_LINE_IOCTL, GPIO_V2_LINE_SET_CONFIG_IOCTL, GPIO_V2_LINE_SET_VALUES_IOCTL), legacy sysfs GPIO, or concurrent in-kernel GPIO/IRQ ops\u2014not via any network or physical bus-facing attack surface.\nAC:L - An attacker drives both racing sides directly: one thread loops IRQ edge-detection setup/teardown (request_irq \u2192 irq_bus_sync_unlock) while another hammers GPIO value/direction writes holding i2c_lock; the original report reproduced the race ~1 in 1000 boots, so deliberate concurrency wins reliably.\nPR:L - Exploitation requires an open file descriptor on /dev/gpiochipN or sysfs GPIO access; on embedded, industrial, medical, and automotive boards using pca953x expanders, udev routinely grants gpio group membership to unprivileged local users.\nUI:N - No victim interaction is required\u2014the attacker performs all GPIO ioctl and IRQ configuration steps in its own threads without needing another user to mount, open, or configure devices.\nS:U - Corruption is confined to the kernel and the same on-board I2C GPIO expander; it does not cross VM, container, IOMMU, or other security-boundary scopes into a different authority.\nC:H - With regmap disable_locking=true, the unprotected pca953x_read_regs() direction read races locked regmap paths, corrupting the maple regcache and returning data from the wrong register\u2014yielding kernel heap UAF read and unintended register-state disclosure.\nI:H - Racing regmap transactions write interrupt-latch/direction data into wrong expander registers (documented output-register corruption), arbitrarily toggling safety-critical GPIO outputs; concurrent unsynchronized regcache writes provide a heap corruption/write primitive.\nA:H - Concurrent regcache maple-tree corruption from unsynchronized regmap access can trigger kernel oops/panic via double-free; miswritten interrupt masks or direction registers can wedge expander IRQ handling and GPIO consumers in a persistent denial-of-service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e2ecdddca80dd845df42376e4b0197fe97018ba2", "lessThan": "5d05c4252c09ce10624be2197853c80bf87424e4", "versionType": "git"}, {"status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "41255e64eb9dd87b0b8675f4e47a9c67bcef6e39", "versionType": "git"}, {"status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "bf3f37c2d40b51deb79aea910f28999d7c8c6b5a", "versionType": "git"}, {"status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090", "versionType": "git"}, {"status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "9dc325327babe7f159e84cbe9380a45342da0585", "versionType": "git"}, {"status": "affected", "version": "58a5c93bd1a6e949267400080f07e57ffe05ec34", "versionType": "git"}, {"status": "affected", "version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41", "versionType": "git"}, {"status": "affected", "version": "6.6.42", "lessThan": "6.6.160", "versionType": "semver"}, {"status": "affected", "version": "6.1.101", "lessThan": "6.2", "versionType": "semver"}, {"status": "affected", "version": "6.9.11", "lessThan": "6.10", "versionType": "semver"}], "programFiles": ["drivers/gpio/gpio-pca953x.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpio/gpio-pca953x.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5d05c4252c09ce10624be2197853c80bf87424e4"}, {"url": "https://git.kernel.org/stable/c/41255e64eb9dd87b0b8675f4e47a9c67bcef6e39"}, {"url": "https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a"}, {"url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"}, {"url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.6.42"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.57", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.1.101"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.9.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:46:19.525Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74733", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:46:19.525Z", "dateReserved": "2026-08-15T05:44:03.930Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:33:21.579Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "58ed56c093a857c19f04cf3db1f02d2e793aec88", "status": "affected", "version": "58a5c93bd1a6e949267400080f07e57ffe05ec34", "versionType": "git"}, {"lessThan": "5d05c4252c09ce10624be2197853c80bf87424e4", "status": "affected", "version": "e2ecdddca80dd845df42376e4b0197fe97018ba2", "versionType": "git"}, {"lessThan": "41255e64eb9dd87b0b8675f4e47a9c67bcef6e39", "status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "versionType": "git"}, {"lessThan": "bf3f37c2d40b51deb79aea910f28999d7c8c6b5a", "status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "versionType": "git"}, {"lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090", "status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "versionType": "git"}, {"lessThan": "9dc325327babe7f159e84cbe9380a45342da0585", "status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "versionType": "git"}, {"status": "affected", "version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41", "versionType": "git"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.101", "versionType": "semver"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.42", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.9.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: pca953x: corregir el bloqueo de regmap en pca953x_irq_bus_sync_unlock\n\nEl bloqueo est\u00e1 deshabilitado en la configuraci\u00f3n de regmap ya que este controlador usa su propio bloqueo. Esto significa que todas las llamadas a funciones de regmap (lectura o escritura) deben mantener el i2c_lock. La funci\u00f3n pca953x_irq_bus_sync_unlock() no hizo esto, y por lo tanto era posible que m\u00faltiples hilos pudieran causar que se leyera/escribiera un registro incorrecto.\n\nUn parche anterior solucion\u00f3 esto parcialmente, pero solo protegi\u00f3 la escritura en el registro de m\u00e1scara de interrupci\u00f3n, y no la lectura del registro de direcci\u00f3n."}], "id": "CVE-2026-74733", "lastModified": "2026-10-30T13:20:05.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74733", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:15:53.820928Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:48.463", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41255e64eb9dd87b0b8675f4e47a9c67bcef6e39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58ed56c093a857c19f04cf3db1f02d2e793aec88"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d05c4252c09ce10624be2197853c80bf87424e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock", "id": "2521408", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521408"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register.", "A flaw was found in the Linux kernel's `gpio: pca953x` driver, which manages General Purpose Input/Output (GPIO) expanders. The driver uses its own locking mechanism, but the `pca953x_irq_bus_sync_unlock()` function failed to acquire the necessary lock when performing register operations. This oversight could allow multiple threads to concurrently access and modify registers, leading to incorrect data being read or written. Such a race condition could result in unpredictable system behavior or data corruption."], "name": "CVE-2026-74733", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74733\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74733\nhttps://lore.kernel.org/linux-cve-announce/2026082242-CVE-2026-74733-9012@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfc6444b57dc7186b6acc964705d7516cbaf3904,e6a2f5f845f50b0c4299bace5111f56d3390a090)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfc6444b57dc7186b6acc964705d7516cbaf3904,9dc325327babe7f159e84cbe9380a45342da0585)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "58a5c93bd1a6e949267400080f07e57ffe05ec34"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e2ecdddca80dd845df42376e4b0197fe97018ba2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.101,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.42,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.9.11,6.10)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:45:04.673601+00:00", "updated": "2026-08-25T18:30:04.987024+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}