Linux Kernel EUVD-2026-64420

Exploitation requires a PCA953x-family I2C GPIO expander (PCA9534, PCA9535, PCA9539, or compatible) to be physically connected and the pca953x kernel module to be loaded - systems without this hardware are completely unaffected. The race window in pca953x_irq_bus_sync_unlock() is triggered during IRQ chip bus-lock release; exploiting it requires the ability to spawn concurrent threads performing IRQ configuration operations, consistent with PR:L (low-privileged local user) per the CVSS vector. The attacker must win a timing race to corrupt register state, which limits reliable reproducibility. What limits exploitation: hardware presence is mandatory, the race window is narrow, and the impact ceiling is GPIO expander register confusion rather than kernel memory corruption or privilege escalation to root.

The NVD-assigned CVSS 7.8 with C:H/I:H/A:H overstates the realistic impact for this specific defect: those metrics imply full system compromise or kernel memory corruption, but the actual consequence is incorrect I2C register access on an external GPIO expander chip - a device-level impact rather than a host kernel exploitation primitive. A calibrated assessment of C:L/I:L/A:L and AC:H (race conditions are not trivially won) better reflects the actual blast radius. EPSS at 0.20% and the 10th percentile independently corroborates negligible exploitation probability. The vulnerability is absent from CISA KEV and no POC exists. Realistic risk is confined to embedded and industrial deployments where GPIO state integrity has safety or operational consequences; general-purpose servers and desktops are structurally unaffected (no PCA953x hardware). The AC:L assignment in the original vector is questionable for a race condition - reliably winning the timing window elevates practical complexity beyond low.

A local attacker with low-privileged shell access on an embedded Linux system equipped with a PCA953x GPIO expander spawns multiple threads that simultaneously initiate IRQ chip configuration updates, each calling into pca953x_irq_bus_sync_unlock(). If the race is won during the unprotected direction register read, an incorrect register value is consumed and the subsequent interrupt mask write targets or populates the wrong device register, misconfiguring GPIO interrupt behavior. No public POC exists; reliable exploitation requires both the specific hardware and precise multi-thread timing.