CVE-2025-38335 (GCVE-0-2025-38335)
Vulnerability from cvelistv5
Published
2025-07-10 08:15
Modified
2025-08-15 15:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context.
Impacted products
Vendor Product Version
Linux Linux Version: 019002f20cb5b9f78d39360aff244265d035e08a
Version: 019002f20cb5b9f78d39360aff244265d035e08a
Version: 019002f20cb5b9f78d39360aff244265d035e08a
Version: 019002f20cb5b9f78d39360aff244265d035e08a
Version: 019002f20cb5b9f78d39360aff244265d035e08a
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/keyboard/gpio_keys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8f01e51109f77229e426b57c5d19251b462c6aa",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "fa53beab4740c4e5fe969f218a379f9558be33dc",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "a7b79db25846459de63ca8974268f0c41c734c4b",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "ec8f5da79b425deef5aebacdd4fe645620cd4f0b",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "f4a8f561d08e39f7833d4a278ebfb12a41eef15f",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/keyboard/gpio_keys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.101",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.41",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: gpio-keys - fix a sleep while atomic with PREEMPT_RT\n\nWhen enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in\nhard irq context, but the input_event() takes a spin_lock, which isn\u0027t\nallowed there as it is converted to a rt_spin_lock().\n\n[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0\n...\n[ 4054.290195]  __might_resched+0x13c/0x1f4\n[ 4054.290209]  rt_spin_lock+0x54/0x11c\n[ 4054.290219]  input_event+0x48/0x80\n[ 4054.290230]  gpio_keys_irq_timer+0x4c/0x78\n[ 4054.290243]  __hrtimer_run_queues+0x1a4/0x438\n[ 4054.290257]  hrtimer_interrupt+0xe4/0x240\n[ 4054.290269]  arch_timer_handler_phys+0x2c/0x44\n[ 4054.290283]  handle_percpu_devid_irq+0x8c/0x14c\n[ 4054.290297]  handle_irq_desc+0x40/0x58\n[ 4054.290307]  generic_handle_domain_irq+0x1c/0x28\n[ 4054.290316]  gic_handle_irq+0x44/0xcc\n\nConsidering the gpio_keys_irq_isr() can run in any context, e.g. it can\nbe threaded, it seems there\u0027s no point in requesting the timer isr to\nrun in hard irq context.\n\nRelax the hrtimer not to use the hard context."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-15T15:16:35.663Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f"
        }
      ],
      "title": "Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38335",
    "datePublished": "2025-07-10T08:15:07.063Z",
    "dateReserved": "2025-04-16T04:51:24.005Z",
    "dateUpdated": "2025-08-15T15:16:35.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38335\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T09:15:28.100\",\"lastModified\":\"2025-08-15T16:15:29.300\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: gpio-keys - fix a sleep while atomic with PREEMPT_RT\\n\\nWhen enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in\\nhard irq context, but the input_event() takes a spin_lock, which isn\u0027t\\nallowed there as it is converted to a rt_spin_lock().\\n\\n[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\\n[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0\\n...\\n[ 4054.290195]  __might_resched+0x13c/0x1f4\\n[ 4054.290209]  rt_spin_lock+0x54/0x11c\\n[ 4054.290219]  input_event+0x48/0x80\\n[ 4054.290230]  gpio_keys_irq_timer+0x4c/0x78\\n[ 4054.290243]  __hrtimer_run_queues+0x1a4/0x438\\n[ 4054.290257]  hrtimer_interrupt+0xe4/0x240\\n[ 4054.290269]  arch_timer_handler_phys+0x2c/0x44\\n[ 4054.290283]  handle_percpu_devid_irq+0x8c/0x14c\\n[ 4054.290297]  handle_irq_desc+0x40/0x58\\n[ 4054.290307]  generic_handle_domain_irq+0x1c/0x28\\n[ 4054.290316]  gic_handle_irq+0x44/0xcc\\n\\nConsidering the gpio_keys_irq_isr() can run in any context, e.g. it can\\nbe threaded, it seems there\u0027s no point in requesting the timer isr to\\nrun in hard irq context.\\n\\nRelax the hrtimer not to use the hard context.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Entrada: gpio-keys - corrige un fallo de suspensi\u00f3n mientras es at\u00f3mico con PREEMPT_RT Al habilitar PREEMPT_RT, la devoluci\u00f3n de llamada gpio_keys_irq_timer() se ejecuta en un contexto de irq duro, pero input_event() toma un spin_lock, que no est\u00e1 permitido all\u00ed ya que se convierte en un rt_spin_lock(). [ 4054.289999] ERROR: funci\u00f3n de suspensi\u00f3n llamada desde un contexto no v\u00e1lido en kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Teniendo en cuenta que gpio_keys_irq_isr() puede ejecutarse en cualquier contexto, por ejemplo, puede ser Enhebrado, parece que no tiene sentido solicitar que el temporizador ISR se ejecute en un contexto de IRQ estricto. Reduzca la velocidad del temporizador hr para que no use dicho contexto.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…