CVE-2025-38335

MEDIUM EPSS 1.7%
Published Jul 10, 202511mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jul 10, 2025 11mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
1.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-667

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥5.13  –  <5.15.190
linuxlinux_kernel*≥5.16  –  <6.1.148
linuxlinux_kernel*≥6.2  –  <6.6.101
linuxlinux_kernel*≥6.7  –  <6.12.41
linuxlinux_kernel*≥6.13  –  <6.15.4
debiandebian_linux11.0any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/664e5a6f541ff226621487d1280d2ec28e86be28
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
    Third Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/664e5a6f541ff226621487d1280d2ec28e86be28
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc
    Patch