Linux Kernel Vulnerability in PCA953X Driver May Lead to Incorrect Register Access

CVE-2026-74733

What is CVE-2026-74733?

A vulnerability exists within the PCA953X driver of the Linux kernel that impacts the integrity of register access due to improper locking mechanisms. Specifically, the function pca953x_irq_bus_sync_unlock() fails to acquire the necessary i2c_lock while performing regmap operations. This oversight allows concurrent threads to potentially manipulate registers simultaneously, leading to inaccurate read or write operations. A previous patch addressed part of this issue by securing access to the interrupt mask register, but the read operations on the direction register were left unprotected, thereby still posing significant risks for data integrity within multi-threaded environments.

References