CVE-2026-74652
Received Received - Intake

Linux Kernel RS485 Timer Use-After-Free Vulnerability

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers. Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74652
EUVD
EUVD-2026-64589

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the serial port driver for RS485 communication. The issue occurs when hrtimers embedded in the port are triggered after the port's IRQ is freed, potentially causing use-after-free errors. The fix ensures timers are canceled before freeing the IRQ and handles cleanup in the remove() function to prevent timer arming during suspend-then-unbind scenarios.

Detection Guidance

This vulnerability is specific to the Linux kernel's serial driver (amba-pl011) and relates to RS485 hrtimers firing after IRQ freeing. Detection requires checking kernel logs for related errors or kernel panic messages involving the amba-pl011 driver or RS485 functionality.

Impact Analysis

This vulnerability could lead to system instability or crashes if exploited, as it involves memory corruption from freed resources being accessed. Systems using RS485 serial communication with affected Linux kernels may experience unexpected behavior or failures.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If immediate patching is not possible, disable RS485 functionality on affected systems as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart