CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Cancel hrtimer before clearing slave pointer

In i2cimxunregslave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2cimxslavetimeout) before the pointer was cleared. If the hrtimer fires after i2cimx->slave is set to NULL, the timer callback i2cimxslavefinishop() will call i2cimxslaveevent() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.