CVE-2026-74461

A flaw was found in the Linux kernel, specifically within the i2c: imx driver. This vulnerability occurs due to a timing issue during device unregistration, where a critical pointer is cleared before a related timer is properly canceled. If a pending interrupt triggers the timer after the pointer is cleared, it results in a NULL pointer dereference. This can lead to a system crash, potentially allowing a local attacker to cause a denial of service.

A race in the i2c imx slave unregister path can leave a pending hrtimer active after the slave pointer is cleared. If the timer callback runs later, i2c_imx_slave_finish_op() can call the slave event path with a NULL or stale slave pointer, causing a kernel crash and creating a use-after-free candidate. For the CVSS the PR:L is used for the paranoid score because a local low privilege service or delegated device management context could potentially trigger slave unregister while the timer race is reachable. The issue is not network reachable over IP. External I2C bus activity may help hit the timing window, but exploitation normally requires local device control or physical bus access. Impact is at least local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to the timer based use-after-free candidate, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.