CVE-2026-74687

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the at91sam9 wdt watchdog driver where the at91 ping() function rearms the watchdog timer from its callback. Because timer delete() does not wait for a running callback or prevent it from rearming the timer, a probe failure or driver removal can result in the timer accessing the devm-allocated at91wdt after it has been freed, leading to a use-after-free scenario.

Recommendations Use timer shutdown sync() on both teardown paths to ensure running callbacks are waited for and any attempts to rearm the timer are rejected.