Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger… (CVE-2026-74652)

The Linux kernel's serial driver for amba-pl011 had a vulnerability where RS485 trigger hrtimers embedded in the devm-managed port could fire after the port was freed, leading to potential use-after-free issues. The IRQ handler could arm a timer after the port was freed, so the fix involves freeing the IRQ before canceling both timers and ensuring timers are canceled in the remove() function during suspend-then-unbind paths where shutdown is not called. This prevents timers from firing after the device is freed, mitigating the risk.

The vulnerability could allow a local attacker with limited privileges to cause use-after-free conditions, potentially leading to system crashes or escalation of privileges due to improper handling of RS485 timers after device removal. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel to address this issue by properly ordering the freeing of IRQs and cancellation of RS485 timers. Users should update to the fixed kernel versions provided by their Linux distribution vendors. Since this is a kernel-level fix, applying official kernel updates is the recommended remediation.