CVE-2026-74687 Overview
CVE-2026-74687 is a use-after-free vulnerability in the Linux kernel's at91sam9_wdt watchdog driver. The flaw resides in the timer teardown logic, where at91_ping() rearms the watchdog timer from its callback. Because timer_delete() neither waits for a running callback nor prevents the callback from rearming the timer, probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt structure after it has been freed. A local attacker with the ability to trigger driver unload or probe failure can exploit the resulting memory corruption.
Critical Impact
Local exploitation can lead to kernel memory corruption, privilege escalation, or denial of service on affected AT91SAM9-based Linux systems.
Affected Products
- Linux kernel (drivers/watchdog/at91sam9_wdt.c)
- Systems using the Atmel/Microchip AT91SAM9 watchdog driver
- Embedded Linux distributions targeting AT91SAM9 SoCs
Discovery Timeline
- 2026-08-22 - CVE-2026-74687 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74687
Vulnerability Analysis
The vulnerability is a classic use-after-free triggered by a race between timer teardown and timer callback execution. In the at91sam9_wdt driver, at91_ping() runs as a timer callback and rearms the same timer during each invocation. The teardown paths used timer_delete(), which returns immediately without synchronizing against an already-running callback and does not prevent that callback from re-arming the timer before it exits.
When probe fails or the driver is removed, devm-managed resources including the at91wdt structure are freed. If the timer callback is executing or gets rearmed during this window, it continues to dereference the freed at91wdt object. Subsequent callback executions operate on memory that may have been reallocated for unrelated kernel objects, corrupting kernel state.
Root Cause
The root cause is an incorrect timer-lifecycle API choice. timer_delete() lacks the semantics required when a callback can self-rearm the timer. The driver assumed timer_delete() was sufficient, but it does not block on in-flight callbacks or reject a rearm requested by the callback itself, producing a lifetime mismatch between the timer and its backing devm allocation.
Attack Vector
Exploitation requires local access with the privileges necessary to trigger driver probe failure or removal, for example by unbinding the device through sysfs or unloading the kernel module. On systems where the AT91SAM9 watchdog driver is loaded, an attacker with local privileges can race the teardown against the periodic ping callback to cause the kernel to access freed memory. The consequences include kernel panics and, depending on heap layout, controlled write-what-where primitives leading to privilege escalation.
No public proof-of-concept exploit is currently available. See the upstream fix commit for technical details of the patched teardown sequence.
Detection Methods for CVE-2026-74687
Indicators of Compromise
- Kernel oops or panic logs referencing at91_ping, at91sam9_wdt, or the watchdog timer callback after a driver unbind or probe failure event.
- KASAN use-after-free reports pointing at the at91wdt structure on kernels built with memory-safety instrumentation.
- Unexpected watchdog device disappearance followed by process crashes on AT91SAM9-based hardware.
Detection Strategies
- Enable CONFIG_KASAN and CONFIG_DEBUG_OBJECTS_TIMERS on test builds to surface stale timer accesses against freed devm allocations.
- Correlate dmesg output around module unload, device unbind, and probe failure events on affected platforms.
- Monitor for repeated automated driver unbind or module reload sequences from unprivileged contexts, which may indicate exploitation attempts.
Monitoring Recommendations
- Ship kernel logs to a centralized log platform and alert on watchdog subsystem crashes or KASAN reports.
- Track writes to /sys/bus/platform/drivers/at91_wdt/unbind and related sysfs paths on production embedded fleets.
- Baseline kernel module load and unload activity, and flag deviations on systems where the watchdog driver is normally static.
How to Mitigate CVE-2026-74687
Immediate Actions Required
- Apply the upstream Linux kernel patch that replaces timer_delete() with timer_shutdown_sync() on both teardown paths in at91sam9_wdt.
- Rebuild and redeploy kernels for all AT91SAM9-based devices, prioritizing production and internet-exposed embedded systems.
- Restrict local shell access and permissions to unbind platform drivers or load and unload kernel modules on affected hosts.
Patch Information
The fix uses timer_shutdown_sync() on both teardown paths. It waits for any running callback to complete and rejects further attempts by the callback to rearm the timer, closing the race between teardown and callback execution. See the referenced kernel commits: 29fe74c9aa69, 8444d66aa6b6, and b7949b0a7d99.
Workarounds
- Where patching is not immediately possible, prevent unprivileged users from triggering driver unbind by tightening permissions on /sys/bus/platform/drivers/at91_wdt/.
- Disable dynamic module loading with kernel.modules_disabled=1 on production kernels that do not require runtime module changes.
- Blacklist the at91sam9_wdt driver on systems where the watchdog is not required, eliminating the attack surface entirely.
# Restrict driver unbind and disable dynamic module changes
chmod 600 /sys/bus/platform/drivers/at91_wdt/unbind
sysctl -w kernel.modules_disabled=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
