A race condition vulnerability in the Linux kernel pca953x GPIO driver could allow a local authenticated attacker to achieve unauthorized register access and potential privilege escalation.

The vulnerability exists within the pca953x_irq_bus_sync_unlock function, where inadequate locking of the i2c_lock during register operations allows multiple threads to access registers concurrently. An attacker with local low-level privileges can trigger this race condition to perform unauthorized read or write operations on device registers.

The exploitation of this flaw can lead to a complete compromise of the affected device, as register manipulation often facilitates privilege escalation or arbitrary code execution within the kernel context. Given the CVSS score of 7.8, this vulnerability poses a high risk to system integrity and confidentiality, particularly in environments where local users may have non-privileged access to the system.

Immediate Action: Update the Linux kernel to version 7.1.9 or later, or apply the upstream patches associated with commit e6a2f5f845f50b0c4299bace5111f56d3390a090.

Proactive Monitoring: Monitor kernel logs for recurring driver-related errors or unexpected register access patterns that may indicate a crash or exploitation attempt.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict kernel module loading policies to minimize the attack surface.

Public Exploit Available: No

This vulnerability represents a significant risk to systems utilizing the pca953x GPIO driver. Administrators should prioritize patching the kernel to the recommended version to eliminate the race condition. Failure to address this flaw leaves the kernel susceptible to local privilege escalation attacks that could bypass standard security boundaries.