Vulnerability-Lookup

GHSA-P6RQ-QPQH-5F25

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-10-15 12:30

Details

In the Linux kernel, the following vulnerability has been resolved:

gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written.

A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74733"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:48Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register.",
  "id": "GHSA-p6rq-qpqh-5f25",
  "modified": "2026-10-15T12:30:44Z",
  "published": "2026-08-22T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74733"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74733 (GCVE-0-2026-74733)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-10-16 19:16

Title

gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

Summary

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written. A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 19:15 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6666 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/bf3f37c2d40b51deb…
https://git.kernel.org/stable/c/e6a2f5f845f50b0c4…
https://git.kernel.org/stable/c/9dc325327babe7f15…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bfc6444b57dc7186b6acc964705d7516cbaf3904 , < bf3f37c2d40b51deb79aea910f28999d7c8c6b5a (git) Affected: bfc6444b57dc7186b6acc964705d7516cbaf3904 , < e6a2f5f845f50b0c4299bace5111f56d3390a090 (git) Affected: bfc6444b57dc7186b6acc964705d7516cbaf3904 , < 9dc325327babe7f159e84cbe9380a45342da0585 (git) Affected: 58a5c93bd1a6e949267400080f07e57ffe05ec34 (git) Affected: e2ecdddca80dd845df42376e4b0197fe97018ba2 (git) Affected: de7cffa53149c7b48bd1bb29b02390c9f05b7f41 (git) Affected: 6.1.101 , < 6.2 (semver) Affected: 6.6.42 , < 6.7 (semver) Affected: 6.9.11 , < 6.10 (semver)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74733",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:15:53.820928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:16:12.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-pca953x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf3f37c2d40b51deb79aea910f28999d7c8c6b5a",
              "status": "affected",
              "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
              "versionType": "git"
            },
            {
              "lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090",
              "status": "affected",
              "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
              "versionType": "git"
            },
            {
              "lessThan": "9dc325327babe7f159e84cbe9380a45342da0585",
              "status": "affected",
              "version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58a5c93bd1a6e949267400080f07e57ffe05ec34",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e2ecdddca80dd845df42376e4b0197fe97018ba2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-pca953x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable pca953x_irq_bus_sync_unlock() path is reached only through local kernel interfaces\u2014GPIO chardev ioctls (GPIO_V2_GET_LINE_IOCTL, GPIO_V2_LINE_SET_CONFIG_IOCTL, GPIO_V2_LINE_SET_VALUES_IOCTL), legacy sysfs GPIO, or concurrent in-kernel GPIO/IRQ ops\u2014not via any network or physical bus-facing attack surface.\nAC:L - An attacker drives both racing sides directly: one thread loops IRQ edge-detection setup/teardown (request_irq \u2192 irq_bus_sync_unlock) while another hammers GPIO value/direction writes holding i2c_lock; the original report reproduced the race ~1 in 1000 boots, so deliberate concurrency wins reliably.\nPR:L - Exploitation requires an open file descriptor on /dev/gpiochipN or sysfs GPIO access; on embedded, industrial, medical, and automotive boards using pca953x expanders, udev routinely grants gpio group membership to unprivileged local users.\nUI:N - No victim interaction is required\u2014the attacker performs all GPIO ioctl and IRQ configuration steps in its own threads without needing another user to mount, open, or configure devices.\nS:U - Corruption is confined to the kernel and the same on-board I2C GPIO expander; it does not cross VM, container, IOMMU, or other security-boundary scopes into a different authority.\nC:H - With regmap disable_locking=true, the unprotected pca953x_read_regs() direction read races locked regmap paths, corrupting the maple regcache and returning data from the wrong register\u2014yielding kernel heap UAF read and unintended register-state disclosure.\nI:H - Racing regmap transactions write interrupt-latch/direction data into wrong expander registers (documented output-register corruption), arbitrarily toggling safety-critical GPIO outputs; concurrent unsynchronized regcache writes provide a heap corruption/write primitive.\nA:H - Concurrent regcache maple-tree corruption from unsynchronized regmap access can trigger kernel oops/panic via double-free; miswritten interrupt masks or direction registers can wedge expander IRQ handling and GPIO consumers in a persistent denial-of-service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T10:09:27.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"
        },
        {
          "url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"
        }
      ],
      "title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74733",
    "datePublished": "2026-08-22T15:33:21.579Z",
    "dateReserved": "2026-08-15T05:44:03.930Z",
    "dateUpdated": "2026-10-16T19:16:12.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted