CVE-2026-74652serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers. Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called. This issue was found by an in-house static analysis tool.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2c1fd53af21b8cb13878b054894d33d3383eb1f3 before 759ead98a39fb625be302f9aa66290985dcaa325; from 2c1fd53af21b8cb13878b054894d33d3383eb1f3 before e57f0aa5c35be37218ba0e4887b241584dd4b2d2; from 2c1fd53af21b8cb13878b054894d33d3383eb1f3 before 36672c8d7d14e9c43287528455d2c97b526ea6ad | CNA record |
References
- https://git.kernel.org/stable/c/759ead98a39fb625be302f9aa66290985dcaa325
- https://git.kernel.org/stable/c/e57f0aa5c35be37218ba0e4887b241584dd4b2d2
- https://git.kernel.org/stable/c/36672c8d7d14e9c43287528455d2c97b526ea6ad
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.