CVE-2026-74461

i2c: imx: Cancel hrtimer before clearing slave pointer

State: Published
Severity: 8.4 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Cancel hrtimer before clearing slave pointer

In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx->slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before e3da77bdb4015051656bb472c295656bbea03b6fAffected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before 470fe15fb3bb2eba6629be301ca7e991ee3cfb7eAffected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before a8a1f9ac3d763e721586f15479ef9140b216ddf3Affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before 753060f2b77ff2f386addbd3ecadb95b9f90cdddAffected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before affd62f5719a78135b7441aa49c8cab3c3b5e838Affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before dab4762ee7f3fd0a01980d5407ba48d0261d3bffAffected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061fAffected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before e3da77bdb4015051656bb472c295656bbea03b6fAffected
f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before 470fe15fb3bb2eba6629be301ca7e991ee3cfb7eAffected
f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before a8a1f9ac3d763e721586f15479ef9140b216ddf3Affected
f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before 753060f2b77ff2f386addbd3ecadb95b9f90cdddAffected
f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before affd62f5719a78135b7441aa49c8cab3c3b5e838Affected
f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before dab4762ee7f3fd0a01980d5407ba48d0261d3bffAffected
f7414cd6923fd7f78e57086fc964ba2dc25db5c1 to before 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061fAffected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.