CVE-2026-74461: i2c: imx: Cancel hrtimer before clearing slave pointer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Cancel hrtimer before clearing slave pointer

In i2c_imx_unreg_slave(), the slave pointer is set to NULL after
disabling interrupts.  However, a pending interrupt might already
have started the hrtimer (i2c_imx_slave_timeout) before the pointer
was cleared.  If the hrtimer fires after i2c_imx->slave is set to
NULL, the timer callback i2c_imx_slave_finish_op() will call
i2c_imx_slave_event() with a NULL slave pointer, which results in a
use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after
disabling interrupts, before clearing the slave pointer.

The Linux kernel CVE team has assigned CVE-2026-74461 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit f7414cd6923fd7f78e57086fc964ba2dc25db5c1 and fixed in 6.6.151 with commit a8a1f9ac3d763e721586f15479ef9140b216ddf3
	Issue introduced in 5.11 with commit f7414cd6923fd7f78e57086fc964ba2dc25db5c1 and fixed in 6.12.103 with commit 753060f2b77ff2f386addbd3ecadb95b9f90cddd
	Issue introduced in 5.11 with commit f7414cd6923fd7f78e57086fc964ba2dc25db5c1 and fixed in 6.18.44 with commit affd62f5719a78135b7441aa49c8cab3c3b5e838
	Issue introduced in 5.11 with commit f7414cd6923fd7f78e57086fc964ba2dc25db5c1 and fixed in 7.1.8 with commit dab4762ee7f3fd0a01980d5407ba48d0261d3bff
	Issue introduced in 5.11 with commit f7414cd6923fd7f78e57086fc964ba2dc25db5c1 and fixed in 7.2-rc6 with commit 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74461
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/i2c/busses/i2c-imx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a8a1f9ac3d763e721586f15479ef9140b216ddf3
	https://git.kernel.org/stable/c/753060f2b77ff2f386addbd3ecadb95b9f90cddd
	https://git.kernel.org/stable/c/affd62f5719a78135b7441aa49c8cab3c3b5e838
	https://git.kernel.org/stable/c/dab4762ee7f3fd0a01980d5407ba48d0261d3bff
	https://git.kernel.org/stable/c/6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f