EUVD-2026-64589
GHSA-9x5x-pxv9-g7vg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between IRQ-armed hrtimer and devm teardown requires precise timing, warranting AC:H rather than the official AC:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers.
Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called.
This issue was found by an in-house static analysis tool.
AnalysisAI
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following must hold: (1) the attacker has local unprivileged access (PR:L) to the target system; (2) the system runs on ARM hardware featuring an ARM PrimeCell PL011 UART controller - x86, RISC-V, and other architectures are not affected; (3) the PL011 UART is configured for RS485 half-duplex mode and is actively in use - the vulnerable hrtimer path is only reachable when RS485 is enabled; (4) the attacker must trigger, or race against, a device removal, suspend, or unbind event concurrent with RS485 activity to produce the use-after-free. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L) accurately reflects kernel-level impact potential, but multiple signals indicate substantially lower real-world risk than the score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unprivileged local user on an ARM embedded system - such as an industrial controller or IoT gateway using PL011 UART with RS485 - initiates a serial transmission and simultaneously triggers device removal or a suspend-then-unbind power management event. The IRQ handler arms an hrtimer in the instant before devm frees the port structure, causing the timer callback to fire on released kernel memory. … |
| Remediation | Upgrade to a patched kernel version: Linux 6.18.45, 7.1.9, or 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to identify all ARM-based Linux systems and their current kernel versions, cross-referencing against your Linux vendor's advisory for CVE-2026-74652. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today