CVE-2026-74652

A flaw was found in the Linux kernel's amba-pl011 serial driver. The RS485 trigger high-resolution timers (hrtimers) can fire after the device management (devm)-managed port is freed. This occurs because the timers are not properly canceled before the interrupt request (IRQ) is freed, allowing a use-after-free condition. A local attacker could potentially exploit this to cause a denial of service.

Red Hat Product Security rates this Linux kernel flaw as having MODERATE impact. A use-after-free was found in the AMBA PL011 serial driver of the Linux kernel: the RS485 trigger high-resolution timers (hrtimers) are embedded in the devm-managed port structure and can fire after that port has been freed, because the timers were not canceled before the interrupt request (IRQ) was freed and the IRQ handler can itself arm a timer, notably on the suspend-then-unbind path where shutdown is not called. A local attacker with low privileges who can trigger device removal or the suspend-then-unbind path on an affected system could exploit this timing window to cause a use-after-free, resulting in a kernel crash and denial of service (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All currently listed Red Hat Enterprise Linux (kernel, kernel-rt) and Red Hat In-Vehicle OS (kernel, kernel-ivos-qualcomm) components are marked NOTAFFECTED because the vulnerable code is not present in the shipped versions. The CVE.org severity (7.8, IMPORTANT) is higher than the Red Hat rating because the upstream record scores high confidentiality and integrity impacts; the technical evidence for this timer use-after-free supports an availability-only impact, so Red Hat assesses it as MODERATE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.