HIGH Introduced in 3.14
watchdog at91sam9 UAF
CVE-2026-74687
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.2MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9_wdt: prevent timer rearm during teardown at91_ping() rearms the watchdog timer from its callback. timer_delete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt after it has been freed. Use timer_shutdown_sync() on both teardown paths. It waits for a running callback and rejects any attempt by the callback to rearm the timer.
02KernelScan AI Analysis
Risk summary
A race condition in the Atmel AT91SAM9 watchdog driver allows the watchdog timer callback to rearm and access device memory after it has been freed during probe failure or driver removal. This can lead to use-after-free memory corruption. The issue requires local access with high privileges to trigger via driver teardown.
Vulnerability analysis
The watchdog timer callback in the AT91SAM9 watchdog driver rearms the timer from within its own callback function. When the driver is torn down—either due to a probe failure or module removal—the teardown code used a timer deletion function that neither waits for a running callback to finish nor prevents it from rearming the timer. This means the callback can continue to access driver-allocated memory after it has already been freed, resulting in a use-after-free. The fix replaces the old timer deletion calls with a synchronous shutdown that waits for any running callback to complete and blocks any rearm attempts, ensuring the timer is fully stopped before memory is released. This vulnerability is reachable locally by a privileged user who can trigger driver probe failure or module removal on a system with the AT91SAM9 watchdog hardware present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 3.14 | 6.18.45 | 29fe74c9aa69 |
| 7.1 | 3.14 | 7.1.9 | b7949b0a7d99 |
| mainline | 3.14 | 7.2 | 8444d66aa6b6 |