SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-74652

HIGH · CVSS 7.8 EPSS 0.13%

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of RS485 trigger hrtimers, which can still fire after the associated IRQ is freed, potentially leading to unexpected behavior or system instability. This issue primarily impacts systems utilizing the AMBA PL011 serial interface, and it should be prioritized by developers and system administrators managing Linux-based environments to ensure stability and reliability. Immediate attention is recommended to mitigate any risks associated with improper timer management in the kernel.

CVE
CVE-2026-74652
Severity
HIGH
CVSS
7.8
EPSS
0.13%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers. Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called. This issue was found by an in-house static analysis tool.