Medium 4.7Published Feb 4, 2026

CVE-2026-23071regmap: Fix race condition in hwspinlock irqsave routine

Updated under an hour ago (Oct 26, 2026, 2:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: regmap: Fix race condition in hwspinlock irqsave routine Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race condition where multiple contexts contending for the lock could overwrite the shared flags variable, potentially corrupting the state for the current lock owner. Fix this by using a local stack variable 'flags' to store the IRQ state temporarily.

CVSS: 4.7 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8698b9364710e7bac84b3af07dd410e39c8c2e08 before e1a7072bc4f958c9e852dc7e57e39f12b0bb44b5; 8698b9364710e7bac84b3af07dd410e39c8c2e08 builds before 766e243ae8c8b27087a4cc605752c0d5ee2daeab; from 8698b9364710e7bac84b3af07dd410e39c8c2e08 before f1e2fe26a51eca95b41420af76d22c2e613efd5e; 8698b9364710e7bac84b3af07dd410e39c8c2e08 builds before 24f31be6ad70537fd7706269d99c92cade465a09; 8698b9364710e7bac84b3af07dd410e39c8c2e08 builds before 4aab0ca0a0f7760e33edcb4e47576064d05128f5; from 8698b9364710e7bac84b3af07dd410e39c8c2e08 before c2d2cf710dc3ee1a69e00b4ed8de607a92a07889; 8698b9364710e7bac84b3af07dd410e39c8c2e08 builds before 4b58aac989c1e3fafb1c68a733811859df388250	CNA record
linux linux_kernel linux:linux_kernel	from 4.15 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e1a7072bc4f958c9e852dc7e57e39f12b0bb44b5	patch
https://git.kernel.org/stable/c/766e243ae8c8b27087a4cc605752c0d5ee2daeab	patch
https://git.kernel.org/stable/c/f1e2fe26a51eca95b41420af76d22c2e613efd5e	patch
https://git.kernel.org/stable/c/24f31be6ad70537fd7706269d99c92cade465a09	patch
https://git.kernel.org/stable/c/4aab0ca0a0f7760e33edcb4e47576064d05128f5	patch
https://git.kernel.org/stable/c/c2d2cf710dc3ee1a69e00b4ed8de607a92a07889	patch
https://git.kernel.org/stable/c/4b58aac989c1e3fafb1c68a733811859df388250	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.