CVE-2026-74652: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74652 Overview

CVE-2026-74652 is a use-after-free vulnerability in the Linux kernel's amba-pl011 serial driver. The RS485 trigger high-resolution timers (hrtimers) are embedded in a devm-managed port structure and can fire after the port has been freed. Because the interrupt request (IRQ) handler can arm a timer, the incorrect teardown order allows the timers to execute against released memory. The issue was identified through an in-house static analysis tool and resolved by freeing the IRQ before canceling both timers, and by canceling timers in remove() for the suspend-then-unbind path where shutdown is not called.

Critical Impact
A local low-privileged actor triggering the driver teardown path can cause kernel memory corruption, leading to denial of service or potential local privilege escalation.

Affected Products

Linux kernel serial: amba-pl011 driver (ARM PrimeCell PL011 UART)
Systems using RS485 mode on PL011 UART hardware
Distributions shipping affected upstream kernel revisions prior to the fix commits

Discovery Timeline

2026-08-22 - CVE-2026-74652 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74652

Vulnerability Analysis

The vulnerability resides in the drivers/tty/serial/amba-pl011.c driver, which supports the ARM PrimeCell PL011 UART. The driver uses two hrtimer instances embedded inside a port structure managed by the device resource management framework (devm). These timers implement RS485 direction-control transitions between transmit and receive phases.

During driver teardown, the timers were not canceled in the correct order relative to IRQ release. Because the IRQ handler can arm an RS485 trigger timer, releasing the port before canceling the timers created a window in which a pending or newly armed timer could fire against freed memory. This constitutes a use-after-free on kernel memory [CWE-416].

The fix also addresses the suspend-then-unbind flow, where shutdown is never invoked. In that path, the driver must cancel outstanding timers directly in remove() to avoid the same freed-memory access.

Root Cause

The root cause is incorrect ordering of resource release. The IRQ handler retained the ability to arm the RS485 hrtimers while those timers were embedded in a devm-managed allocation subject to automatic release. Additionally, the RS485 stop path armed a timer during shutdown, and the suspend-then-unbind code path bypassed timer cancellation entirely.

Attack Vector

Exploitation requires local access with the ability to interact with the affected UART device or trigger its unbind, suspend, or shutdown sequences. An attacker capable of racing driver teardown against RS485 timer arming from the IRQ handler can induce the use-after-free, corrupting kernel memory. Refer to the upstream commits 36672c8d, 759ead98, and e57f0aa5 for the corrected teardown sequence.

Detection Methods for CVE-2026-74652

Indicators of Compromise

Kernel oops or panic messages referencing pl011_rs485_tx_stop, pl011_shutdown, or hrtimer callbacks after device unbind or suspend.
KASAN (Kernel Address Sanitizer) reports of use-after-free in amba-pl011 symbols on systems where KASAN is enabled.
Unexpected system instability during PL011 UART unbind, hot-remove, or resume on hardware configured for RS485.

Detection Strategies

Inventory Linux hosts and embedded devices running kernels with the affected amba-pl011 driver revision and compare against the patched commit hashes.
Enable KASAN and lockdep in test builds for platforms using PL011 in RS485 mode to surface teardown-time memory violations.
Correlate dmesg output and crash-dump backtraces referencing hrtimer expiry inside freed port memory.

Monitoring Recommendations

Forward kernel logs to a central telemetry pipeline and alert on repeated PL011-related oops or KASAN reports.
Track kernel package versions across ARM-based fleets and flag hosts running pre-patch builds.
Monitor device unbind, suspend, and resume events on systems that expose PL011 UARTs to userspace or unprivileged workloads.

How to Mitigate CVE-2026-74652

Immediate Actions Required

Update to a Linux kernel that includes commits 36672c8d, 759ead98, and e57f0aa5.
Restrict local access to systems exposing PL011 UARTs configured for RS485 until patches are deployed.
Audit permissions on /dev/ttyAMA* device nodes to ensure only trusted users can interact with the driver.

Patch Information

The upstream fix reorders driver teardown so the IRQ is freed before both RS485 hrtimers are canceled. The RS485 stop path no longer arms a timer, and remove() cancels timers to cover the suspend-then-unbind path where shutdown is not invoked. Apply vendor-supplied kernel updates that backport these commits into your distribution or embedded build.

Workarounds

Disable RS485 mode on affected PL011 UARTs where the feature is not required.
Avoid dynamic unbind and suspend-then-unbind operations on the amba-pl011 driver until the patched kernel is in place.
Tighten udev rules and filesystem permissions to prevent unprivileged local users from interacting with PL011 device nodes.

bash

# Verify running kernel version and check for the patched commits in your distribution's changelog
uname -r
git log --oneline drivers/tty/serial/amba-pl011.c | grep -E "36672c8d|759ead98|e57f0aa5"