CVE-2026-74733: Linux Kernel GPIO Race Condition Vulnerability

CVE-2026-74733 Overview

CVE-2026-74733 is a race condition in the Linux kernel's pca953x GPIO driver. The flaw resides in pca953x_irq_bus_sync_unlock(), which failed to acquire the driver's i2c_lock before invoking regmap functions. Because locking is disabled in the regmap configuration for this driver, all regmap read and write calls must be protected by the driver-managed lock. When multiple threads enter the unlock path concurrently, the direction register read and the interrupt mask register write can operate on incorrect data, leading to corrupted GPIO or interrupt state on the I2C-attached expander.

Critical Impact
A local attacker with the ability to trigger concurrent GPIO interrupt configuration on affected systems can cause register corruption, resulting in confidentiality, integrity, and availability impact on the kernel's GPIO subsystem.

Affected Products

Linux kernel — gpio-pca953x driver (pre-fix versions)
Systems using PCA953x, PCA955x, and compatible I2C GPIO expanders
Distributions shipping the vulnerable kernel driver prior to the referenced stable commits

Discovery Timeline

2026-08-22 - CVE-2026-74733 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74733

Vulnerability Analysis

The pca953x driver manages I2C-attached GPIO expanders and disables regmap's internal locking because it maintains its own i2c_lock mutex. This design contract requires every regmap call, whether a read or a write, to occur while holding i2c_lock. The function pca953x_irq_bus_sync_unlock() violated that contract.

A prior partial fix guarded the write to the interrupt mask register but left the preceding read from the direction register unprotected. When two threads reconfigure GPIO interrupts on the same expander, one thread can execute the unlocked direction register read while another thread is mid-transaction on the same I2C bus. The result is that the register contents used to compute the new interrupt mask can be stale or interleaved with unrelated I2C traffic on the shared bus.

This is a classic race condition combined with a Time-of-Check Time-of-Use (TOCTOU) window between reading the direction register and writing the interrupt mask register. Impact is local because triggering the race requires the ability to invoke GPIO interrupt configuration from user or kernel context on the target system.

Root Cause

The root cause is a missing lock acquisition in pca953x_irq_bus_sync_unlock(). The driver's regmap instance is configured with locking disabled, delegating serialization to i2c_lock. Failing to hold that lock during the direction register read breaks the driver's concurrency invariant.

Attack Vector

Exploitation requires local access with the privilege needed to trigger GPIO IRQ reconfiguration on the affected expander. The attack vector is local with low attack complexity, but requires concurrent operations on the same GPIO chip to hit the narrow race window. See the upstream fixes at Kernel Git Commit 9dc3253 and Kernel Git Commit e6a2f5f for the exact code paths.

Detection Methods for CVE-2026-74733

Indicators of Compromise

Unexpected changes to GPIO direction or interrupt mask registers on PCA953x-family expanders observed via /sys/kernel/debug/gpio or gpioinfo
Kernel log entries indicating unexplained GPIO interrupt storms, stuck lines, or missed edge events on I2C GPIO expanders
I2C bus errors correlated with concurrent GPIO IRQ configuration activity

Detection Strategies

Inventory running kernels and compare against the fixed commits 9dc3253 and e6a2f5f to identify unpatched hosts
Audit workloads that reconfigure GPIO interrupts from multiple threads or processes, as these are prerequisites for triggering the race
Enable kernel lockdep and KCSAN in test environments to surface concurrent regmap access on pca953x code paths

Monitoring Recommendations

Forward kernel logs to a centralized store and alert on repeated pca953x or i2c warnings
Track kernel package versions across the fleet and flag hosts running vulnerable gpio-pca953x builds
Monitor for anomalous GPIO state changes on embedded and industrial systems where PCA953x expanders control physical actuators

How to Mitigate CVE-2026-74733

Immediate Actions Required

Apply the upstream fix by updating to a kernel that includes commits 9dc3253 and e6a2f5f
Prioritize patching embedded, IoT, and industrial systems using PCA953x-family GPIO expanders
Restrict local access and limit which processes can reconfigure GPIO interrupts on affected hardware

Patch Information

The fix wraps the direction register read inside pca953x_irq_bus_sync_unlock() with the driver's i2c_lock, ensuring all regmap accesses honor the driver's locking contract. Refer to Kernel Git Commit 9dc3253 and Kernel Git Commit e6a2f5f for the patch content and backport branches. Rebuild custom or vendor kernels against these commits and redeploy.

Workarounds

Serialize userspace GPIO interrupt configuration to a single thread per PCA953x device until the patch is applied
Remove or blacklist the gpio-pca953x module on systems where the expander is not required
Reduce local attack surface by enforcing least privilege on accounts that can access /dev/gpiochip* and related interfaces

bash

# Verify running kernel and check for the fix commits in the source tree
uname -r
git -C /usr/src/linux log --oneline | grep -E '9dc32532|e6a2f5f8'

# Restrict access to GPIO character devices
chown root:gpio /dev/gpiochip*
chmod 660 /dev/gpiochip*