CVE-2026-74547
In the Linux kernel, the following vulnerability has been resolved: hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread When userspace configures 'auto_update_interval' to 0 via sysfs, the background kthread executes schedule_timeout_interruptible(0), which returns immediately. If 'num_temp_sensors' is concurrently or previously set to 0, the msleep_interruptible() delay inside adt7470_read_temperatures() also becomes 0. This combination forces the background thread into a tight, unbounded busy-loop, hogging the CPU and flooding the I2C bus with a continuous stream of transactions. Fix this vulnerability by raising the lower limit of the clamp_val in auto_update_interval_store() from 0 to 500 milliseconds. This guarantees a reasonable minimum sleep window between sensor updates, protecting the system from intentional or accidental I2C bus denial of service.
Affected versions
Linux kernel versions
2.6.29
and later are affected. Fixed in
6.6.151,
6.12.103,
6.18.44,
7.1.8,
7.2-rc6
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-74547?
CVE-2026-74547 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.29 onward and has been patched in 6.6.151, 6.12.103, 6.18.44 and others. CVE-2026-74547 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74547?
Yes. CVE-2026-74547 has been patched. Fixed versions include 6.6.151, 6.12.103, 6.18.44 and others. If you are running Linux kernel 2.6.29 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74547 actively exploited?
No. CVE-2026-74547 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.