Race condition in Linux kernel - CVE-2026-74733
Published: August 24, 2026
Vulnerability identifier: #VU144601
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74733
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause unintended register reads or writes.
The vulnerability exists due to improper synchronization in pca953x_irq_bus_sync_unlock() in the gpio-pca953x driver when handling interrupt state changes and accessing regmap without holding the i2c_lock. A local user can trigger concurrent operations to cause unintended register reads or writes.
The issue arises because multiple threads may access regmap operations without the required driver lock.
Affected software
Linux kernel
How to mitigate CVE-2026-74733
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3