CVE-2026-74733gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written. A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bfc6444b57dc7186b6acc964705d7516cbaf3904 before bf3f37c2d40b51deb79aea910f28999d7c8c6b5a; from bfc6444b57dc7186b6acc964705d7516cbaf3904 before e6a2f5f845f50b0c4299bace5111f56d3390a090; from bfc6444b57dc7186b6acc964705d7516cbaf3904 before 9dc325327babe7f159e84cbe9380a45342da0585; 58a5c93bd1a6e949267400080f07e57ffe05ec34; e2ecdddca80dd845df42376e4b0197fe97018ba2; de7cffa53149c7b48bd1bb29b02390c9f05b7f41; from 6.1.101 before 6.2; from 6.6.42 before 6.7; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a
- https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090
- https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.