CVE-2026-74749

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...

UBUNTU-CVE-2026-74749

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...

CVE-2026-74749

CVE-2026-74749 affects the Linux kernel 's rseq (restricted sequence) subsystem. When __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled, a granted time slice extension calls hrtimer_rearm_deferred_tif(), which in turn calls __hrtimer_rearm_deferred() — a ...

CVE-2026-74749 rseq: Prevent hard lockup on granted time slice extension

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...

PT-2026-82129

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A hard lockup can occur during a granted time slice extension. The function exit to user mode loop calls rseq grant timeslice extension while interrupts are enabled. If the extension is...

Linux Distros Unpatched Vulnerability : CVE-2026-74749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes...

CVE-2026-74652

A flaw was found in the Linux kernel's amba-pl011 serial driver. The RS485 trigger high-resolution timers hrtimers can fire after the device management devm-managed port is freed. This occurs because the timers are not properly canceled before the interrupt request IRQ is freed, allowing a...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed a race condition between bpftimercancelandfree and bpftimercancel. This race condition could lead to a UAF Use-After-Free error involving the timer-timer variable. Here’s the detailed explanation: In bpftimer...

CVE-2026-74652

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74652

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74652 serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74652 serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

SUSE CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

AZL-96147 CVE-2026-74461 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

UBUNTU-CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

Summary (CVE-2026-74461) In the Linux kernel’s i2c_imx driver, the failure path occurs when an interrupt-driven hrtimer can fire after the slave pointer is set to NULL but before the pointer is cleared, leading to a use-after-free/NULL pointer dereference in the timer callback (i2c_imx_slave_fini...

CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...