GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74652 (GCVE-0-2026-74652)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers. Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called. This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2c1fd53af21b8cb13878b054894d33d3383eb1f3 , < 759ead98a39fb625be302f9aa66290985dcaa325 (git)
Affected: 2c1fd53af21b8cb13878b054894d33d3383eb1f3 , < e57f0aa5c35be37218ba0e4887b241584dd4b2d2 (git)
Affected: 2c1fd53af21b8cb13878b054894d33d3383eb1f3 , < 36672c8d7d14e9c43287528455d2c97b526ea6ad (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/amba-pl011.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "759ead98a39fb625be302f9aa66290985dcaa325",
              "status": "affected",
              "version": "2c1fd53af21b8cb13878b054894d33d3383eb1f3",
              "versionType": "git"
            },
            {
              "lessThan": "e57f0aa5c35be37218ba0e4887b241584dd4b2d2",
              "status": "affected",
              "version": "2c1fd53af21b8cb13878b054894d33d3383eb1f3",
              "versionType": "git"
            },
            {
              "lessThan": "36672c8d7d14e9c43287528455d2c97b526ea6ad",
              "status": "affected",
              "version": "2c1fd53af21b8cb13878b054894d33d3383eb1f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/amba-pl011.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: amba-pl011: cancel RS485 hrtimers after freeing IRQ\n\nThe RS485 trigger hrtimers are embedded in the devm-managed port and can\nfire after it is freed. The IRQ handler can arm a timer, so free the IRQ\nfirst and then cancel both timers.\n\nComplete the RS485 stop without arming a timer, and cancel the timers\nin remove() for the suspend-then-unbind path, where shutdown is not\ncalled.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the PL011 UART/RS485 driver and is reached only via local tty access (open/ioctl TIOCSRS485, write, close) on /dev/ttyAMA* or similar nodes; it is not reachable from the network or from RS485 bus traffic alone without local device control.\nAC:L - An attacker with tty access can enable RS485, queue TX with RTS delay timers, and close or race teardown to arm hrtimers during shutdown/remove; they control both the TX state machine and teardown timing, making the race reliably triggerable.\nPR:L - Exploitation requires write access to the UART tty device (typically dialout group membership), not root; ioctl/write/close drive the RS485 timers and buggy shutdown path, while the suspend-then-unbind heap UAF needs admin but is not the minimum privilege bar.\nUI:N - No victim interaction is required; the attacker who holds the tty fd performs TIOCSRS485, transmission, and port close or coordinates teardown themselves without needing another user to act.\nS:U - Impact is confined to kernel memory and hardware on the same host (crash, corruption, potential privilege escalation); it does not cross VM, container, or IOMMU security boundaries.\nC:H - RS485 hrtimers embedded in the devm uart_amba_port can fire after the port is freed during remove or buggy shutdown, causing a use-after-free that exposes freed kernel heap contents and enables arbitrary memory read primitives.\nI:H - UAF timer callbacks (pl011_trigger_start_tx/pl011_trigger_stop_tx) continue operating on freed uart_amba_port memory, performing MMIO reads/writes and state updates that enable heap grooming and kernel data corruption or control-flow hijacking.\nA:H - Use-after-free and concurrent hrtimer callbacks during/after port teardown can cause kernel oops, panic, or hang; RS485 timers may also fire on a partially shut down UART, destabilizing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:10.525Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/759ead98a39fb625be302f9aa66290985dcaa325"
        },
        {
          "url": "https://git.kernel.org/stable/c/e57f0aa5c35be37218ba0e4887b241584dd4b2d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/36672c8d7d14e9c43287528455d2c97b526ea6ad"
        }
      ],
      "title": "serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74652",
    "datePublished": "2026-08-22T15:32:27.799Z",
    "dateReserved": "2026-08-15T05:44:03.923Z",
    "dateUpdated": "2026-08-25T05:41:10.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74652",
      "date": "2026-09-16",
      "epss": "0.00127",
      "percentile": "0.02733"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74652\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:38.693\",\"lastModified\":\"2026-08-25T06:18:45.730\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: amba-pl011: cancel RS485 hrtimers after freeing IRQ\\n\\nThe RS485 trigger hrtimers are embedded in the devm-managed port and can\\nfire after it is freed. The IRQ handler can arm a timer, so free the IRQ\\nfirst and then cancel both timers.\\n\\nComplete the RS485 stop without arming a timer, and cancel the timers\\nin remove() for the suspend-then-unbind path, where shutdown is not\\ncalled.\\n\\nThis issue was found by an in-house static analysis tool.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/serial/amba-pl011.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2c1fd53af21b8cb13878b054894d33d3383eb1f3\",\"lessThan\":\"759ead98a39fb625be302f9aa66290985dcaa325\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c1fd53af21b8cb13878b054894d33d3383eb1f3\",\"lessThan\":\"e57f0aa5c35be37218ba0e4887b241584dd4b2d2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c1fd53af21b8cb13878b054894d33d3383eb1f3\",\"lessThan\":\"36672c8d7d14e9c43287528455d2c97b526ea6ad\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/serial/amba-pl011.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36672c8d7d14e9c43287528455d2c97b526ea6ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/759ead98a39fb625be302f9aa66290985dcaa325\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e57f0aa5c35be37218ba0e4887b241584dd4b2d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:53:13+00:00",
      "cve": "CVE-2026-74652",
      "id": "CVE-2026-74652",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74652.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:08:03Z",
      "cve": "CVE-2026-74652",
      "id": "CVE-2026-74652",
      "initial_release_date": "2026-08-28T16:39:25Z",
      "product_status:known_not_affected": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74652",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74652.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.