Look up another CVE · open CVE-2026-74687 in the interactive tracker
CVE-2026-74687
watchdog: at91sam9_wdt: prevent timer rearm during teardown
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem drivers/watchdog. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-74687 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
at91_ping() rearms the watchdog timer from its callback. timer_delete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt after it has been freed. Use timer_shutdown_sync() on both teardown paths. It waits for a running callback and rejects any attempt by the callback to rearm the timer.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/watchdog/at91sam9_wdt.c
- What this is
- WATCHDOG DEVICE DRIVERSMAINTAINERS section matched on drivers/watchdog/ · linux-watchdog@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into at91sam9_wdt, and Debian does not compile it into that module, so finding at91sam9_wdt in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_AT91SAM9X_WATCHDOG|CONFIG_WATCHDOG' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_AT91SAM9X_WATCHDOG, CONFIG_WATCHDOG
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/watchdog
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.14 | 6.18.45 | 29fe74c9aa69 |
| 3.14 | 7.1.9 | b7949b0a7d99 |
| 3.14 | 7.2 | 8444d66aa6b6 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is in the AT91SAM9 platform watchdog driver during probe-failure cleanup or driver removal; it is reached only via local kernel/platform actions (boot probe, module load/unload, sysfs bind/unbind), not from network, Bluetooth, or physical USB/serial input paths.
- AC:LAttack complexity, low
- at91_ping() unconditionally re-arms with mod_timer() while timer_delete() neither waits for the callback nor blocks rearm; an attacker who can time teardown or trigger the automatic probe-failure path can reliably race the periodic jiffies callback without uncontrollable layout or victim state.
- PR:LPrivileges required, low
- Per CNA driver timer-teardown UAF precedent, once mod_timer() arms at91_ping() the callback runs autonomously; the UAF is reachable from local probe-failure cleanup or driver-removal activity on AT91 embedded/industrial targets without requiring init-namespace root privileges.
- UI:NUser interaction, none
- No victim interaction is required; the kernel timer fires on its own schedule and the use-after-free occurs during automatic init-failure teardown or driver removal, independent of opening /dev/watchdog or other user actions.
- S:UScope, unchanged
- Impact is a kernel heap/timer use-after-free within the host kernel on an embedded AT91 SoC; it does not cross VM, container, or IOMMU security boundaries.
- C:HConfidentiality impact, high
- The at91_ping() timer callback dereferences freed at91wdt fields (next_heartbeat, wdd, heartbeat, base) after devm release, providing sprayable arbitrary kernel memory disclosure per UAF guidance.
- I:HIntegrity impact, high
- Reuse of the freed at91wdt lets at91_wdt_reset() issue MMIO writes through a controlled base pointer and mod_timer() corrupt timer/heap metadata, enabling arbitrary write and control-flow hijack primitives.
- A:HAvailability impact, high
- Use-after-free access from the timer softirq path to freed at91wdt memory causes kernel oops or panic even without deliberate exploitation, and can be repeated by cycling probe/removal against the still-rearming timer.