CVE-2026-74733
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written. A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-22 16:16:48.463000
Last modified
2026-10-30 13:20:05.110000
View original CVE JSON
{
"id": "CVE-2026-74733",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-22T16:16:48.463",
"lastModified": "2026-10-30T13:20:05.110",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: pca953x: corregir el bloqueo de regmap en pca953x_irq_bus_sync_unlock\n\nEl bloqueo está deshabilitado en la configuración de regmap ya que este controlador usa su propio bloqueo. Esto significa que todas las llamadas a funciones de regmap (lectura o escritura) deben mantener el i2c_lock. La función pca953x_irq_bus_sync_unlock() no hizo esto, y por lo tanto era posible que múltiples hilos pudieran causar que se leyera/escribiera un registro incorrecto.\n\nUn parche anterior solucionó esto parcialmente, pero solo protegió la escritura en el registro de máscara de interrupción, y no la lectura del registro de dirección."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/gpio/gpio-pca953x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "58a5c93bd1a6e949267400080f07e57ffe05ec34",
"lessThan": "58ed56c093a857c19f04cf3db1f02d2e793aec88",
"versionType": "git",
"status": "affected"
},
{
"version": "e2ecdddca80dd845df42376e4b0197fe97018ba2",
"lessThan": "5d05c4252c09ce10624be2197853c80bf87424e4",
"versionType": "git",
"status": "affected"
},
{
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"lessThan": "41255e64eb9dd87b0b8675f4e47a9c67bcef6e39",
"versionType": "git",
"status": "affected"
},
{
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"lessThan": "bf3f37c2d40b51deb79aea910f28999d7c8c6b5a",
"versionType": "git",
"status": "affected"
},
{
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090",
"versionType": "git",
"status": "affected"
},
{
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"lessThan": "9dc325327babe7f159e84cbe9380a45342da0585",
"versionType": "git",
"status": "affected"
},
{
"version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41",
"versionType": "git",
"status": "affected"
},
{
"version": "6.1.101",
"lessThan": "6.1.191",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.6.42",
"lessThan": "6.6.160",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.9.11",
"lessThan": "6.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/gpio/gpio-pca953x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.10",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.10",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.114",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.9",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T19:15:53.820928Z",
"id": "CVE-2026-74733",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41255e64eb9dd87b0b8675f4e47a9c67bcef6e39",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/58ed56c093a857c19f04cf3db1f02d2e793aec88",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5d05c4252c09ce10624be2197853c80bf87424e4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}