https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:15:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74461 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>i2c: imx: Cancel hrtimer before clearing slave pointer</p> <p>In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx-&gt;slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.</p> <p>Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>i2c: imx: Cancel hrtimer before clearing slave pointer</p> <p>In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx-&gt;slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.</p> <p>Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.</p> https://vulnerability.circl.lu/vuln/cve-2026-74461