CVE-2026-74733: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-74733 is a race condition vulnerability in the Linux kernel's gpio-pca953x driver, specifically in the pca953x_irq_bus_sync_unlock() function. The flaw allows multiple threads to concurrently access GPIO direction and interrupt mask registers without proper synchronization, potentially corrupting register state. Affected kernel versions include 6.1.101–6.1.x (before 6.2), 6.6.42–6.6.x (before 6.7), 6.9.11–6.9.x (before 6.10), and 6.10.x up to the fix. The CVE was published on August 22, 2026, and a patch is available. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a concurrency/locking defect (race condition) in drivers/gpio/gpio-pca953x.c. The pca953x driver disables regmap's built-in locking and instead relies on its own i2c_lock to serialize all I2C register accesses. The pca953x_irq_bus_sync_unlock() function failed to acquire i2c_lock before reading the GPIO direction register, even though a prior partial fix had added locking around the write to the interrupt mask register. This omission means two or more threads executing this code path concurrently can read stale or incorrect direction register values and subsequently write incorrect interrupt mask values, corrupting driver state. The vulnerability is classified as a race condition / improper synchronization issue; no formal CWE has been assigned in NVD yet (GitHub Advisory, Feedly).

Exploitation of this vulnerability can corrupt GPIO pin direction configuration and interrupt mask register values, leading to loss of GPIO interrupt handling functionality on affected hardware. The impact is limited to systems using the pca953x I2C GPIO expander driver and is primarily a local integrity and availability concern — an attacker or process with access to trigger concurrent GPIO interrupt handling paths could destabilize GPIO-dependent subsystems. There is no evidence of confidentiality impact or potential for remote exploitation or lateral movement (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access to a system running an affected kernel version with the pca953x GPIO driver loaded and active. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Apply the upstream kernel patches that extend i2c_lock protection to cover all regmap operations in pca953x_irq_bus_sync_unlock(), including the read from the direction register. The fixes are available at kernel.org stable commits e6a2f5f845f50b0c4299bace5111f56d3390a090 and 9dc325327babe7f159e84cbe9380a45342da0585. Patched stable releases include kernel 7.1.9 and 7.2+. Systems running kernel versions 6.1.101–6.1.x, 6.6.42–6.6.x, 6.9.11–6.9.x, or 6.10.x with the pca953x driver should prioritize updating to a patched kernel version (GitHub Advisory, Feedly).