CVE-2025-38335
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-12-16
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.16 (inc) to 6.1.148 (inc) |
| debian | debian_linux | 11.0 |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's gpio-keys input driver when the PREEMPT_RT patch is enabled. The gpio_keys_irq_timer() callback runs in a hard interrupt context, but it calls input_event(), which takes a spin_lock. Taking a spin_lock in hard interrupt context is not allowed because it is converted to a real-time spin lock (rt_spin_lock), which can cause the kernel to attempt to sleep in an atomic context, leading to a BUG. The fix involves relaxing the high-resolution timer (hrtimer) so it does not run in hard interrupt context, preventing the invalid sleep call.
How can this vulnerability impact me? :
This vulnerability can cause kernel crashes or instability due to the kernel attempting to sleep while holding a spin lock in hard interrupt context. This can lead to system bugs, degraded reliability, or potential denial of service if the kernel becomes unresponsive or crashes.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific kernel error messages indicating a sleeping function called from an invalid context. Look for messages similar to: '[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48' and stack traces involving input_event and gpio_keys_irq_timer. You can use the command 'dmesg | grep -i "sleeping function called from invalid context"' or 'journalctl -k | grep -i "sleeping function called from invalid context"' to find such occurrences.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the gpio-keys fix for PREEMPT_RT is applied. This fix relaxes the hrtimer so it does not run in hard IRQ context, preventing the invalid sleep in atomic context. Until the update is applied, avoid enabling PREEMPT_RT with gpio-keys or monitor for the issue and consider disabling affected features if possible.