CVE-2026-74733

A flaw was found in the Linux kernel's gpio: pca953x driver, which manages General Purpose Input/Output (GPIO) expanders. The driver uses its own locking mechanism, but the pca953x_irq_bus_sync_unlock() function failed to acquire the necessary lock when performing register operations. This oversight could allow multiple threads to concurrently access and modify registers, leading to incorrect data being read or written. Such a race condition could result in unpredictable system behavior or data corruption.

This vulnerability is rated as Low severity because exploitation requires local system access and relies on the presence of specialized PCA953x I2C GPIO expander hardware rarely present in standard enterprise server environments. The underlying race condition manifests only when multiple threads concurrently trigger interrupt synchronization operations on systems equipped with these controllers. Standard enterprise deployments remain largely unaffected in practice, with potential exposure restricted to specific embedded or customized platforms utilizing this peripheral hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.