CVE-2026-74461
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer…
- Risk score
- 66/100
- CVSS
- 8.4 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 15 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the Linux kernel's i2c: imx module allows a use-after-free / NULL pointer dereference. An attacker could exploit this to gain high privileges, read, modify or impact the integrity or availability of the system.
- Affected
- {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}
- Fix
- Check the linked advisory for the fix, as no specific version is given.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-74461: In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer… (CVSS 8.4 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8960-1: Linux kernel (OEM) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8959-1: Linux kernel vulnerabilities
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 96 in the last 90 days
Why it is Amber
- CVSS 8.4 high
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8959-1
- https://ubuntu.com/security/notices/USN-8960-1
- https://git.kernel.org/stable/c/470fe15fb3bb2eba6629be301ca7e991ee3cfb7e
- https://git.kernel.org/stable/c/6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f
- https://git.kernel.org/stable/c/753060f2b77ff2f386addbd3ecadb95b9f90cddd
- https://git.kernel.org/stable/c/a8a1f9ac3d763e721586f15479ef9140b216ddf3
- https://git.kernel.org/stable/c/affd62f5719a78135b7441aa49c8cab3c3b5e838
- https://git.kernel.org/stable/c/dab4762ee7f3fd0a01980d5407ba48d0261d3bff
- https://git.kernel.org/stable/c/e3da77bdb4015051656bb472c295656bbea03b6f
Original description
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx->slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference. Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.
Last activity 3 Nov 2026. Patch Forecast updates every hour.