CVE-2026-74733

Received Received - Intake

GPIO PCA953x Regmap Locking Issue in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written. A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74733

EUVD

EUVD-2026-64420

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's GPIO PCA953x driver. It involves improper locking in the regmap configuration where the driver uses its own lock instead of regmap's. The function pca953x_irq_bus_sync_unlock() failed to hold the i2c_lock during register reads and writes, allowing multiple threads to access incorrect registers simultaneously.

Detection Guidance

This vulnerability is specific to the Linux kernel's gpio: pca953x driver and requires kernel-level inspection. Check if your system uses the affected driver by running: lsmod | grep pca953x. If loaded, verify kernel logs for regmap or gpio-related errors using: dmesg | grep -i pca953x or journalctl -k | grep -i pca953x.

Impact Analysis

This could lead to race conditions where incorrect register values are read or written, potentially causing system instability, unexpected behavior, or hardware malfunctions in systems using PCA953x GPIO expanders.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue involving incorrect register access due to missing locks, which could lead to data corruption or system instability but does not involve data privacy or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-74733. If using a custom kernel, apply the patch for pca953x_irq_bus_sync_unlock() to ensure regmap functions hold the i2c_lock. Reboot the system after applying updates.

Hi! I’m here to help you understand CVE-2026-74733. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70