Executive brief
The Linux kernel's AT91 watchdog timer driver (at91sam9_wdt) contains a use-after-free vulnerability in its cleanup code. When the driver is removed or initialization fails, a timer callback can continue to execute and access already-freed memory, potentially causing system crashes or unexpected behavior in devices using AT91 microcontrollers.
Technical details
The vulnerability is a use-after-free flaw in the at91sam9_wdt driver's timer management. The at91_ping() function rearms the watchdog timer from within its callback, but the driver used timer_delete() during teardown (probe failure or driver removal), which neither waits for a running callback nor prevents it from rearming. This allows the timer callback to continue executing and access devm-allocated memory after it has been freed. The fix replaces timer_delete() with timer_shutdown_sync() on both teardown paths, which synchronously waits for any running callback to complete and prevents the callback from rearming the timer. Affected versions are those containing the original code before commit 8444d66aa6b6e7fe0a26fa1a00a11cb4d0523783.
Affected products
- Linux Linux kernel Versions containing at91sam9_wdt driver before fix commit 8444d66aa6b6e7fe0a26fa1a00a11cb4d0523783
Timeline
- 2026-08-22: disclosed: CVE-2026-74687 published
- 2026-08-06: patched: Fix commit 8444d66aa6b6e7fe0a26fa1a00a11cb4d0523783 authored