github - ghsa-jm39-49q3-98mm

GHSA-JM39-49Q3-98MM

Vulnerability from github – Published: 2025-07-10 09:32 – Updated: 2025-12-16 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT

When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock().

[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc

Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context.

Relax the hrtimer not to use the hard context.

Severity ?

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-667"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-10T09:15:28Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: gpio-keys - fix a sleep while atomic with PREEMPT_RT\n\nWhen enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in\nhard irq context, but the input_event() takes a spin_lock, which isn\u0027t\nallowed there as it is converted to a rt_spin_lock().\n\n[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0\n...\n[ 4054.290195]  __might_resched+0x13c/0x1f4\n[ 4054.290209]  rt_spin_lock+0x54/0x11c\n[ 4054.290219]  input_event+0x48/0x80\n[ 4054.290230]  gpio_keys_irq_timer+0x4c/0x78\n[ 4054.290243]  __hrtimer_run_queues+0x1a4/0x438\n[ 4054.290257]  hrtimer_interrupt+0xe4/0x240\n[ 4054.290269]  arch_timer_handler_phys+0x2c/0x44\n[ 4054.290283]  handle_percpu_devid_irq+0x8c/0x14c\n[ 4054.290297]  handle_irq_desc+0x40/0x58\n[ 4054.290307]  generic_handle_domain_irq+0x1c/0x28\n[ 4054.290316]  gic_handle_irq+0x44/0xcc\n\nConsidering the gpio_keys_irq_isr() can run in any context, e.g. it can\nbe threaded, it seems there\u0027s no point in requesting the timer isr to\nrun in hard irq context.\n\nRelax the hrtimer not to use the hard context.",
  "id": "GHSA-jm39-49q3-98mm",
  "modified": "2025-12-16T18:31:29Z",
  "published": "2025-07-10T09:32:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38335"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/664e5a6f541ff226621487d1280d2ec28e86be28"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38335 (GCVE-0-2025-38335)

Vulnerability from cvelistv5 – Published: 2025-07-10 08:15 – Updated: 2025-11-03 17:36

Title

Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT

Summary

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context.

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/664e5a6f541ff2266…
	https://git.kernel.org/stable/c/a8f01e51109f77229…
	https://git.kernel.org/stable/c/fa53beab4740c4e5f…
	https://git.kernel.org/stable/c/a7b79db25846459de…
	https://git.kernel.org/stable/c/ec8f5da79b425deef…
	https://git.kernel.org/stable/c/f4a8f561d08e39f78…

Impacted products

Vendor

Product

Version

Linux

Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < 664e5a6f541ff226621487d1280d2ec28e86be28 (git)
Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < a8f01e51109f77229e426b57c5d19251b462c6aa (git)
Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < fa53beab4740c4e5fe969f218a379f9558be33dc (git)
Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < a7b79db25846459de63ca8974268f0c41c734c4b (git)
Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < ec8f5da79b425deef5aebacdd4fe645620cd4f0b (git)
Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < f4a8f561d08e39f7833d4a278ebfb12a41eef15f (git)

Linux

Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.148 , ≤ 6.1.* (semver)
Unaffected: 6.6.101 , ≤ 6.6.* (semver)
Unaffected: 6.12.41 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:36:43.814Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/keyboard/gpio_keys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "664e5a6f541ff226621487d1280d2ec28e86be28",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "a8f01e51109f77229e426b57c5d19251b462c6aa",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "fa53beab4740c4e5fe969f218a379f9558be33dc",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "a7b79db25846459de63ca8974268f0c41c734c4b",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "ec8f5da79b425deef5aebacdd4fe645620cd4f0b",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            },
            {
              "lessThan": "f4a8f561d08e39f7833d4a278ebfb12a41eef15f",
              "status": "affected",
              "version": "019002f20cb5b9f78d39360aff244265d035e08a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/keyboard/gpio_keys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.101",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.41",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: gpio-keys - fix a sleep while atomic with PREEMPT_RT\n\nWhen enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in\nhard irq context, but the input_event() takes a spin_lock, which isn\u0027t\nallowed there as it is converted to a rt_spin_lock().\n\n[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0\n...\n[ 4054.290195]  __might_resched+0x13c/0x1f4\n[ 4054.290209]  rt_spin_lock+0x54/0x11c\n[ 4054.290219]  input_event+0x48/0x80\n[ 4054.290230]  gpio_keys_irq_timer+0x4c/0x78\n[ 4054.290243]  __hrtimer_run_queues+0x1a4/0x438\n[ 4054.290257]  hrtimer_interrupt+0xe4/0x240\n[ 4054.290269]  arch_timer_handler_phys+0x2c/0x44\n[ 4054.290283]  handle_percpu_devid_irq+0x8c/0x14c\n[ 4054.290297]  handle_irq_desc+0x40/0x58\n[ 4054.290307]  generic_handle_domain_irq+0x1c/0x28\n[ 4054.290316]  gic_handle_irq+0x44/0xcc\n\nConsidering the gpio_keys_irq_isr() can run in any context, e.g. it can\nbe threaded, it seems there\u0027s no point in requesting the timer isr to\nrun in hard irq context.\n\nRelax the hrtimer not to use the hard context."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-28T14:43:02.863Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/664e5a6f541ff226621487d1280d2ec28e86be28"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f"
        }
      ],
      "title": "Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38335",
    "datePublished": "2025-07-10T08:15:07.063Z",
    "dateReserved": "2025-04-16T04:51:24.005Z",
    "dateUpdated": "2025-11-03T17:36:43.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-JM39-49Q3-98MM

CVE-2025-38335 (GCVE-0-2025-38335)

Tags

Sightings

Nomenclature