EUVD-2026-64420
GHSA-p6rq-qpqh-5f25
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise thread timing (AC:H); impact limited to I2C GPIO register confusion on external device, not kernel memory (C:L/I:L/A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written.
A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register.
AnalysisAI
Race condition in the Linux kernel's GPIO PCA953x driver allows local low-privileged users on systems with PCA953x I2C GPIO expander hardware to trigger incorrect register reads or writes by exploiting missing mutex coverage in pca953x_irq_bus_sync_unlock(). A prior partial fix protected only the interrupt mask register write but left the direction register read unguarded, permitting concurrent threads to interleave I2C transactions and corrupt GPIO expander state on affected kernel stable branches including 6.1.101-6.2, 6.6.42-6.7, and 6.9.11-6.10. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a PCA953x-family I2C GPIO expander (PCA9534, PCA9535, PCA9539, or compatible) to be physically connected and the pca953x kernel module to be loaded - systems without this hardware are completely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 with C:H/I:H/A:H overstates the realistic impact for this specific defect: those metrics imply full system compromise or kernel memory corruption, but the actual consequence is incorrect I2C register access on an external GPIO expander chip - a device-level impact rather than a host kernel exploitation primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privileged shell access on an embedded Linux system equipped with a PCA953x GPIO expander spawns multiple threads that simultaneously initiate IRQ chip configuration updates, each calling into pca953x_irq_bus_sync_unlock(). If the race is won during the unprotected direction register read, an incorrect register value is consumed and the subsequent interrupt mask write targets or populates the wrong device register, misconfiguring GPIO interrupt behavior. … |
| Remediation | Vendor-released fix commits are available in the Linux stable kernel: e6a2f5f845f50b0c4299bace5111f56d3390a090 at https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090 and 9dc325327babe7f159e84cbe9380a45342da0585 at https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585, with patched stable releases including kernel 7.1.9 and 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running the affected Linux kernel versions (6.1.101-6.2, 6.6.42-6.7, or 6.9.11-6.10) with PCA953x I2C GPIO expander hardware attached. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today