CVE-2026-74687 watchdog: at91sam9_wdt: prevent timer rearm during teardown
A use-after-free vulnerability in the Linux kernel's at91sam9 watchdog driver allows attackers to cause denial of service or execute code during driver teardown.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74687?
CVE-2026-74687 is a high-severity use after free vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
watchdog: at91sam9_wdt: prevent timer rearm during teardown
at91_ping() rearms the watchdog timer from its callback. timer_delete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt after it has been freed.
Use timer_shutdown_sync() on both teardown paths. It waits for a running callback and rejects any attempt by the callback to rearm the timer.
Which versions are affected by CVE-2026-74687?
How do I fix CVE-2026-74687?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-74687 being exploited?
There is no known exploitation of CVE-2026-74687 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74687, DEBIAN-CVE-2026-74687, GHSA-x3hg-mqqh-m29v, UBUNTU-CVE-2026-74687.