{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74733", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.930Z", "datePublished": "2026-08-22T15:33:21.579Z", "dateUpdated": "2026-08-25T05:42:11.965Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:42:11.965Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable pca953x_irq_bus_sync_unlock() path is reached only through local kernel interfaces\u2014GPIO chardev ioctls (GPIO_V2_GET_LINE_IOCTL, GPIO_V2_LINE_SET_CONFIG_IOCTL, GPIO_V2_LINE_SET_VALUES_IOCTL), legacy sysfs GPIO, or concurrent in-kernel GPIO/IRQ ops\u2014not via any network or physical bus-facing attack surface.\nAC:L - An attacker drives both racing sides directly: one thread loops IRQ edge-detection setup/teardown (request_irq \u2192 irq_bus_sync_unlock) while another hammers GPIO value/direction writes holding i2c_lock; the original report reproduced the race ~1 in 1000 boots, so deliberate concurrency wins reliably.\nPR:L - Exploitation requires an open file descriptor on /dev/gpiochipN or sysfs GPIO access; on embedded, industrial, medical, and automotive boards using pca953x expanders, udev routinely grants gpio group membership to unprivileged local users.\nUI:N - No victim interaction is required\u2014the attacker performs all GPIO ioctl and IRQ configuration steps in its own threads without needing another user to mount, open, or configure devices.\nS:U - Corruption is confined to the kernel and the same on-board I2C GPIO expander; it does not cross VM, container, IOMMU, or other security-boundary scopes into a different authority.\nC:H - With regmap disable_locking=true, the unprotected pca953x_read_regs() direction read races locked regmap paths, corrupting the maple regcache and returning data from the wrong register\u2014yielding kernel heap UAF read and unintended register-state disclosure.\nI:H - Racing regmap transactions write interrupt-latch/direction data into wrong expander registers (documented output-register corruption), arbitrarily toggling safety-critical GPIO outputs; concurrent unsynchronized regcache writes provide a heap corruption/write primitive.\nA:H - Concurrent regcache maple-tree corruption from unsynchronized regmap access can trigger kernel oops/panic via double-free; miswritten interrupt masks or direction registers can wedge expander IRQ handling and GPIO consumers in a persistent denial-of-service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "versions": [{"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090", "status": "affected", "versionType": "git"}, {"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "lessThan": "9dc325327babe7f159e84cbe9380a45342da0585", "status": "affected", "versionType": "git"}, {"version": "58a5c93bd1a6e949267400080f07e57ffe05ec34", "status": "affected", "versionType": "git"}, {"version": "e2ecdddca80dd845df42376e4b0197fe97018ba2", "status": "affected", "versionType": "git"}, {"version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41", "status": "affected", "versionType": "git"}, {"version": "6.1.101", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.42", "lessThan": "6.7", "status": "affected", "versionType": "semver"}, {"version": "6.9.11", "lessThan": "6.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"}, {"url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"}], "title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090", "status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "versionType": "git"}, {"lessThan": "9dc325327babe7f159e84cbe9380a45342da0585", "status": "affected", "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904", "versionType": "git"}, {"status": "affected", "version": "58a5c93bd1a6e949267400080f07e57ffe05ec34", "versionType": "git"}, {"status": "affected", "version": "e2ecdddca80dd845df42376e4b0197fe97018ba2", "versionType": "git"}, {"status": "affected", "version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41", "versionType": "git"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.101", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.42", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.9.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-pca953x.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."}], "id": "CVE-2026-74733", "lastModified": "2026-08-25T06:18:59.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:48.463", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock", "id": "2521408", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521408"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register.", "A flaw was found in the Linux kernel's `gpio: pca953x` driver, which manages General Purpose Input/Output (GPIO) expanders. The driver uses its own locking mechanism, but the `pca953x_irq_bus_sync_unlock()` function failed to acquire the necessary lock when performing register operations. This oversight could allow multiple threads to concurrently access and modify registers, leading to incorrect data being read or written. Such a race condition could result in unpredictable system behavior or data corruption."], "name": "CVE-2026-74733", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74733\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74733\nhttps://lore.kernel.org/linux-cve-announce/2026082242-CVE-2026-74733-9012@gregkh/T"], "threat_severity": "Low"}