CVE-2026-74461

Received Received - Intake

NULL Pointer Dereference in Linux Kernel i2c-imx Driver

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx->slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference. Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-05

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74461

EUVD

EUVD-2026-59654

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free or NULL pointer dereference vulnerability in the Linux kernel's i2c imx driver. It occurs when the slave pointer is cleared before canceling a pending hrtimer, leading to a timer callback accessing a NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's i2c subsystem and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors related to i2c_imx or hrtimer. Commands like dmesg | grep -i 'i2c_imx\|NULL pointer' or journalctl -k | grep -i 'i2c_imx\|NULL pointer' may help identify issues.

Impact Analysis

This could cause system crashes, instability, or potential privilege escalation if exploited. Systems using the affected i2c imx driver may experience unexpected behavior or security issues.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue involving a use-after-free in the i2c subsystem. Compliance impacts would depend on how the affected system is used in a broader context, not the vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the i2c_imx slave functionality if not required, or apply vendor-specific mitigations if available.

Hi! I’m here to help you understand CVE-2026-74461. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70