Linux Kernel CVE-2026-74687

Exploitation requires physical or logical access to a Linux system running on AT91 SAM9 SoC hardware with the at91sam9_wdt watchdog driver loaded - this driver is not present or active on any other hardware platform. The race window is triggered during driver teardown: either by unloading the at91sam9_wdt module (typically requiring CAP_SYS_MODULE / root-equivalent privileges) or by a probe failure during boot initialization (not user-triggerable in most configurations). The CVSS PR:L assignment implies the kernel team considers non-root triggering possible in some configurations, but the specific path is not confirmed in the description. Exploitation requires winning a timing race between the timer callback and memory deallocation, which adds non-determinism. Systems that do not use the AT91 SAM9 watchdog peripheral, or where the driver is blacklisted, are not affected regardless of kernel version.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as High severity, reflecting the full CIA impact achievable from a kernel use-after-free. However, several signals significantly temper real-world risk: EPSS is 0.21% (11th percentile), indicating very low observed exploitation probability; the vulnerability is not in CISA KEV; and no public exploit or POC is known. The AV:L/AC:L assignment deserves scrutiny - this is a race condition, which typically implies AC:H; the assigned AC:L may reflect the kernel team's judgment that the race window is consistently reachable under normal probe-failure or unload conditions, but independent assessment suggests AC:H is more accurate. PR:L in the official vector implies exploitation is possible without root, yet triggering driver unload (rmmod) on a production system typically requires CAP_SYS_MODULE (root-equivalent). Probe failure races occur at boot time and are not ordinarily user-triggerable. Critically, this driver only executes on systems physically equipped with AT91 SAM9 SoC hardware - effectively restricting exposure to embedded and industrial Linux deployments on Microchip silicon. For mainstream x86/ARM server and desktop Linux environments, this vulnerability is irrelevant. The combination of hardware specificity, race timing requirements, low EPSS, and no active exploitation makes this a low real-world priority despite the High CVSS base score.

An attacker with local access on an embedded Linux system based on an Atmel/Microchip AT91 SAM9 SoC - such as an industrial controller or IoT gateway - triggers watchdog driver removal (e.g., via rmmod at91sam9_wdt on a system where this is permitted, or by inducing probe failure at boot). If the at91_ping() timer callback fires in the narrow window between devm memory release and timer cancellation, the callback writes into freed memory, potentially corrupting kernel heap structures. A sophisticated attacker could shape the heap to place controlled data at the freed address, redirecting execution flow to achieve privilege escalation to root. No public POC exists at time of analysis, meaning this would require original exploit development.