GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38632 (GCVE-0-2025-38632)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:00 – Updated: 2026-05-23 16:00
VLAI
Title
pinmux: fix race causing mux_owner NULL with active mux_usecount
Summary
In the Linux kernel, the following vulnerability has been resolved: pinmux: fix race causing mux_owner NULL with active mux_usecount commit 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") tried to address the issue when two client of the same gpio calls pinctrl_select_state() for the same functionality, was resulting in NULL pointer issue while accessing desc->mux_owner. However, issue was not completely fixed due to the way it was handled and it can still result in the same NULL pointer. The issue occurs due to the following interleaving: cpu0 (process A) cpu1 (process B) pin_request() { pin_free() { mutex_lock() desc->mux_usecount--; //becomes 0 .. mutex_unlock() mutex_lock(desc->mux) desc->mux_usecount++; // becomes 1 desc->mux_owner = owner; mutex_unlock(desc->mux) mutex_lock(desc->mux) desc->mux_owner = NULL; mutex_unlock(desc->mux) This sequence leads to a state where the pin appears to be in use (`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can cause NULL pointer on next pin_request on the same pin. Ensure that updates to mux_usecount and mux_owner are performed atomically under the same lock. Only clear mux_owner when mux_usecount reaches zero and no new owner has been assigned.
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b , < 9b2a3e7189028aa7c4d53a84364f2ea9fb209787 (git)
Affected: c11e2ec9a780f54982a187ee10ffd1b810715c85 , < 9ea3f6b9a67be3476e331ce51cac316c2614a564 (git)
Affected: 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e , < b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804 (git)
Affected: 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e , < 22b585cbd67d14df3b91529d1b990661c300faa9 (git)
Affected: 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e , < 0b075c011032f88d1cfde3b45d6dcf08b44140eb (git)
Affected: 6.6.66 , < 6.6.102 (semver)
Affected: 6.12.5 , < 6.12.42 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.6.102 , ≤ 6.6.* (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/pinmux.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9b2a3e7189028aa7c4d53a84364f2ea9fb209787",
              "status": "affected",
              "version": "2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b",
              "versionType": "git"
            },
            {
              "lessThan": "9ea3f6b9a67be3476e331ce51cac316c2614a564",
              "status": "affected",
              "version": "c11e2ec9a780f54982a187ee10ffd1b810715c85",
              "versionType": "git"
            },
            {
              "lessThan": "b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804",
              "status": "affected",
              "version": "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e",
              "versionType": "git"
            },
            {
              "lessThan": "22b585cbd67d14df3b91529d1b990661c300faa9",
              "status": "affected",
              "version": "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e",
              "versionType": "git"
            },
            {
              "lessThan": "0b075c011032f88d1cfde3b45d6dcf08b44140eb",
              "status": "affected",
              "version": "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.102",
              "status": "affected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.42",
              "status": "affected",
              "version": "6.12.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/pinmux.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "6.6.66",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.12.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: fix race causing mux_owner NULL with active mux_usecount\n\ncommit 5a3e85c3c397 (\"pinmux: Use sequential access to access\ndesc-\u003epinmux data\") tried to address the issue when two client of the\nsame gpio calls pinctrl_select_state() for the same functionality, was\nresulting in NULL pointer issue while accessing desc-\u003emux_owner.\nHowever, issue was not completely fixed due to the way it was handled\nand it can still result in the same NULL pointer.\n\nThe issue occurs due to the following interleaving:\n\n     cpu0 (process A)                   cpu1 (process B)\n\n      pin_request() {                   pin_free() {\n\n                                         mutex_lock()\n                                         desc-\u003emux_usecount--; //becomes 0\n                                         ..\n                                         mutex_unlock()\n\n  mutex_lock(desc-\u003emux)\n  desc-\u003emux_usecount++; // becomes 1\n  desc-\u003emux_owner = owner;\n  mutex_unlock(desc-\u003emux)\n\n                                         mutex_lock(desc-\u003emux)\n                                         desc-\u003emux_owner = NULL;\n                                         mutex_unlock(desc-\u003emux)\n\nThis sequence leads to a state where the pin appears to be in use\n(`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can\ncause NULL pointer on next pin_request on the same pin.\n\nEnsure that updates to mux_usecount and mux_owner are performed\natomically under the same lock. Only clear mux_owner when mux_usecount\nreaches zero and no new owner has been assigned."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:00:13.275Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9b2a3e7189028aa7c4d53a84364f2ea9fb209787"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ea3f6b9a67be3476e331ce51cac316c2614a564"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804"
        },
        {
          "url": "https://git.kernel.org/stable/c/22b585cbd67d14df3b91529d1b990661c300faa9"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b075c011032f88d1cfde3b45d6dcf08b44140eb"
        }
      ],
      "title": "pinmux: fix race causing mux_owner NULL with active mux_usecount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38632",
    "datePublished": "2025-08-22T16:00:40.423Z",
    "dateReserved": "2025-04-16T04:51:24.029Z",
    "dateUpdated": "2026-05-23T16:00:13.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38632",
      "date": "2026-09-16",
      "epss": "0.00114",
      "percentile": "0.01659"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38632\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-22T16:15:37.033\",\"lastModified\":\"2026-06-17T09:17:15.300\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npinmux: fix race causing mux_owner NULL with active mux_usecount\\n\\ncommit 5a3e85c3c397 (\\\"pinmux: Use sequential access to access\\ndesc-\u003epinmux data\\\") tried to address the issue when two client of the\\nsame gpio calls pinctrl_select_state() for the same functionality, was\\nresulting in NULL pointer issue while accessing desc-\u003emux_owner.\\nHowever, issue was not completely fixed due to the way it was handled\\nand it can still result in the same NULL pointer.\\n\\nThe issue occurs due to the following interleaving:\\n\\n     cpu0 (process A)                   cpu1 (process B)\\n\\n      pin_request() {                   pin_free() {\\n\\n                                         mutex_lock()\\n                                         desc-\u003emux_usecount--; //becomes 0\\n                                         ..\\n                                         mutex_unlock()\\n\\n  mutex_lock(desc-\u003emux)\\n  desc-\u003emux_usecount++; // becomes 1\\n  desc-\u003emux_owner = owner;\\n  mutex_unlock(desc-\u003emux)\\n\\n                                         mutex_lock(desc-\u003emux)\\n                                         desc-\u003emux_owner = NULL;\\n                                         mutex_unlock(desc-\u003emux)\\n\\nThis sequence leads to a state where the pin appears to be in use\\n(`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can\\ncause NULL pointer on next pin_request on the same pin.\\n\\nEnsure that updates to mux_usecount and mux_owner are performed\\natomically under the same lock. Only clear mux_owner when mux_usecount\\nreaches zero and no new owner has been assigned.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pinmux: correcci\u00f3n de la carrera que causaba que mux_owner fuera nulo con el commit 5a3e85c3c397 de mux_usecount activa (\\\"pinmux: Usar acceso secuencial para acceder a los datos de desc-\u0026gt;pinmux\\\"). Se intent\u00f3 solucionar el problema cuando dos clientes del mismo GPIO llamaban a pinctrl_select_state() para la misma funcionalidad, lo que provocaba un problema de puntero nulo al acceder a desc-\u0026gt;mux_owner. Sin embargo, el problema no se solucion\u00f3 por completo debido a la forma en que se gestion\u00f3 y a\u00fan puede resultar en el mismo puntero nulo. El problema se produce debido a la siguiente intercalaci\u00f3n: cpu0 (proceso A) cpu1 (proceso B) pin_request() { pin_free() { mutex_lock() desc-\u0026gt;mux_usecount--; //se convierte en 0 .. mutex_unlock() mutex_lock(desc-\u0026gt;mux) desc-\u0026gt;mux_usecount++; // se convierte en 1 desc-\u0026gt;mux_owner = owner; mutex_unlock(desc-\u0026gt;mux) mutex_lock(desc-\u0026gt;mux) desc-\u0026gt;mux_owner = NULL; mutex_unlock(desc-\u0026gt;mux) Esta secuencia lleva a un estado donde el pin parece estar en uso (`mux_usecount == 1`) pero no tiene propietario (`mux_owner == NULL`), lo que puede generar un puntero nulo en la siguiente solicitud de pin en el mismo pin. Aseg\u00farese de que las actualizaciones de mux_usecount y mux_owner se realicen autom\u00e1ticamente bajo el mismo bloqueo. Solo borre mux_owner cuando mux_usecount llegue a cero y no se haya asignado un nuevo propietario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pinctrl/pinmux.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b\",\"lessThan\":\"9b2a3e7189028aa7c4d53a84364f2ea9fb209787\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c11e2ec9a780f54982a187ee10ffd1b810715c85\",\"lessThan\":\"9ea3f6b9a67be3476e331ce51cac316c2614a564\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e\",\"lessThan\":\"b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e\",\"lessThan\":\"22b585cbd67d14df3b91529d1b990661c300faa9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e\",\"lessThan\":\"0b075c011032f88d1cfde3b45d6dcf08b44140eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.66\",\"lessThan\":\"6.6.102\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.5\",\"lessThan\":\"6.12.42\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pinctrl/pinmux.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.102\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.42\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.10\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.1\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.66\",\"versionEndExcluding\":\"6.6.102\",\"matchCriteriaId\":\"6EAE34E7-89EB-40E1-814B-1BB1C091AEB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.5\",\"versionEndExcluding\":\"6.12.42\",\"matchCriteriaId\":\"7DB522F7-D2D4-487E-9B58-506480D775C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.10\",\"matchCriteriaId\":\"5890C690-B295-40C2-9121-FF5F987E5142\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.1\",\"matchCriteriaId\":\"58182352-D7DF-4CC9-841E-03C1D852C3FB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b075c011032f88d1cfde3b45d6dcf08b44140eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/22b585cbd67d14df3b91529d1b990661c300faa9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b2a3e7189028aa7c4d53a84364f2ea9fb209787\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ea3f6b9a67be3476e331ce51cac316c2614a564\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:13:49+00:00",
      "cve": "CVE-2025-38632",
      "id": "CVE-2025-38632",
      "initial_release_date": "2025-08-22T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: pinmux: fix race causing mux_owner NULL with active mux_usecount",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38632.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:48:25Z",
      "cve": "CVE-2025-38632",
      "id": "CVE-2025-38632",
      "initial_release_date": "2025-08-25T23:24:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "393",
      "product_status:recommended": "509",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38632",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38632.json",
      "version": "46"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.