« Volver al listado

CVE-2026-80562

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

gpio: ml-ioh: use raw_spinlock_t for the register lock

ioh_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip->spinlock with spin_lock_irqsave(). This callback is reached from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled. That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is an rtmutex-backed sleeping lock, so acquiring it there is invalid. ioh_irq_enable() and ioh_irq_disable() take the same lock from the .irq_enable/.irq_disable callbacks, which are likewise invoked with desc->lock held.

Leer descripción completaMostrar menos

Convert the register lock to raw_spinlock_t. The same lock also serializes the GPIO direction/value callbacks and the suspend/resume register save/restore, and those critical sections only perform short sequences of MMIO register accesses (ioread32()/iowrite32()); the .irq_set_type callback additionally emits a dev_warn() on an unsupported type. None of these are sleepable operations, so keeping this register lock non-sleeping is appropriate for the irqchip callbacks and does not change the GPIO-side locking contract.

This is the same fix as commit a02b8950d619 ("gpio: pch: use raw_spinlock_t for the register lock"); this driver shares the same structure as gpio-pch.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80562",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "431b10133113537660a6090a2856b0d74d1b06de",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "359e6b1168c9a62a7bd214ace476aaa2d57eebe8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "63d2230e5076c12f93d2a1d1bff2fbbf6cf32f3c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "b6505a4cea45dd92eb753581b1ad9b524b5fcc34",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "84be002b40d30c56a91873b236e2d9001bbee363",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "bc7934d0acd4fc1c7e5b7c68debdb4a991121628",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "0559b86611c35d342dd48542ea26a9e437046bf6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be566317b6aece2389a95bb19ea209af9359be",
              "lessThan": "600411ea1f2443fdf5b1af9b6480f616d7aff9d0",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpio/gpio-ml-ioh.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpio/gpio-ml-ioh.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-26T15:17:11.183",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0559b86611c35d342dd48542ea26a9e437046bf6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/359e6b1168c9a62a7bd214ace476aaa2d57eebe8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/431b10133113537660a6090a2856b0d74d1b06de",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/600411ea1f2443fdf5b1af9b6480f616d7aff9d0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/63d2230e5076c12f93d2a1d1bff2fbbf6cf32f3c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/84be002b40d30c56a91873b236e2d9001bbee363",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b6505a4cea45dd92eb753581b1ad9b524b5fcc34",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc7934d0acd4fc1c7e5b7c68debdb4a991121628",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: ml-ioh: use raw_spinlock_t for the register lock\n\nioh_irq_type() is registered as the irq_chip .irq_set_type callback and\ntakes chip->spinlock with spin_lock_irqsave().  This callback is reached\nfrom __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while\nthe caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.\nThat context is not sleepable, but on PREEMPT_RT a regular spinlock_t is\nan rtmutex-backed sleeping lock, so acquiring it there is invalid.\nioh_irq_enable() and ioh_irq_disable() take the same lock from the\n.irq_enable/.irq_disable callbacks, which are likewise invoked with\ndesc->lock held.\n\nConvert the register lock to raw_spinlock_t.  The same lock also\nserializes the GPIO direction/value callbacks and the suspend/resume\nregister save/restore, and those critical sections only perform short\nsequences of MMIO register accesses (ioread32()/iowrite32()); the\n.irq_set_type callback additionally emits a dev_warn() on an unsupported\ntype.  None of these are sleepable operations, so keeping this register\nlock non-sleeping is appropriate for the irqchip callbacks and does not\nchange the GPIO-side locking contract.\n\nThis is the same fix as commit a02b8950d619 (\"gpio: pch: use\nraw_spinlock_t for the register lock\"); this driver shares the same\nstructure as gpio-pch."
    }
  ],
  "lastModified": "2026-08-27T13:18:40.533",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}