« Volver al listado

CVE-2025-38388

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context

The current use of a mutex to protect the notifier hashtable accesses can lead to issues in the atomic context. It results in the below kernel warnings:

To address this, replace the mutex with an rwlock to protect the notifier hashtable accesses. This ensures that read-side locking does not sleep and multiple readers can acquire the lock concurrently, avoiding unnecessary contention and potential deadlocks. Writer access remains exclusive, preserving correctness.

Leer descripción completaMostrar menos

This change resolves warnings from lockdep about potential sleep in atomic context.

Detalles técnicos trazas, registros y código del informe original
  |  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258
  |  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0
  |  preempt_count: 1, expected: 0
  |  RCU nest depth: 0, expected: 0
  |  CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4
  |  Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn
  |  Call trace:
  |   show_stack+0x18/0x24 (C)
  |   dump_stack_lvl+0x78/0x90
  |   dump_stack+0x18/0x24
  |   __might_resched+0x114/0x170
  |   __might_sleep+0x48/0x98
  |   mutex_lock+0x24/0x80
  |   handle_notif_callbacks+0x54/0xe0
  |   notif_get_and_handle+0x40/0x88
  |   generic_exec_single+0x80/0xc0
  |   smp_call_function_single+0xfc/0x1a0
  |   notif_pcpu_irq_work_fn+0x2c/0x38
  |   process_one_work+0x14c/0x2b4
  |   worker_thread+0x2e4/0x3e0
  |   kthread+0x13c/0x210
  |   ret_from_fork+0x10/0x20

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-38388",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e0573444edbf4ee7e3c191d3d08a4ccbd26628be",
              "lessThan": "31405510a48dcf054abfa5b7b8d70ce1b27d1f13",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e0573444edbf4ee7e3c191d3d08a4ccbd26628be",
              "lessThan": "8986f8f61b482c0e6efd28f0b2423d9640c20eb1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e0573444edbf4ee7e3c191d3d08a4ccbd26628be",
              "lessThan": "9ca7a421229bbdfbe2e1e628cff5cfa782720a10",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/firmware/arm_ffa/driver.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/firmware/arm_ffa/driver.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-07-25T13:15:28.127",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/31405510a48dcf054abfa5b7b8d70ce1b27d1f13",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8986f8f61b482c0e6efd28f0b2423d9640c20eb1",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ca7a421229bbdfbe2e1e628cff5cfa782720a10",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context\n\nThe current use of a mutex to protect the notifier hashtable accesses\ncan lead to issues in the atomic context. It results in the below\nkernel warnings:\n\n  |  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258\n  |  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0\n  |  preempt_count: 1, expected: 0\n  |  RCU nest depth: 0, expected: 0\n  |  CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4\n  |  Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn\n  |  Call trace:\n  |   show_stack+0x18/0x24 (C)\n  |   dump_stack_lvl+0x78/0x90\n  |   dump_stack+0x18/0x24\n  |   __might_resched+0x114/0x170\n  |   __might_sleep+0x48/0x98\n  |   mutex_lock+0x24/0x80\n  |   handle_notif_callbacks+0x54/0xe0\n  |   notif_get_and_handle+0x40/0x88\n  |   generic_exec_single+0x80/0xc0\n  |   smp_call_function_single+0xfc/0x1a0\n  |   notif_pcpu_irq_work_fn+0x2c/0x38\n  |   process_one_work+0x14c/0x2b4\n  |   worker_thread+0x2e4/0x3e0\n  |   kthread+0x13c/0x210\n  |   ret_from_fork+0x10/0x20\n\nTo address this, replace the mutex with an rwlock to protect the notifier\nhashtable accesses. This ensures that read-side locking does not sleep and\nmultiple readers can acquire the lock concurrently, avoiding unnecessary\ncontention and potential deadlocks. Writer access remains exclusive,\npreserving correctness.\n\nThis change resolves warnings from lockdep about potential sleep in\natomic context."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_ffa: Reemplazar mutex por rwlock para evitar la suspensión en contexto atómico El uso actual de un mutex para proteger los accesos a la tabla hash del notificador puede provocar problemas en el contexto atómico. Esto da como resultado las siguientes advertencias del kernel: | BUG: función de suspensión llamada desde un contexto no válido en kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest Depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 No contaminado 6.14.0 #4 | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Rastreo de llamadas: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | handle_notif_callbacks+0x54/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | work_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20 Para solucionar esto, reemplace el mutex con un rwlock para proteger los accesos a la tabla hash del notificador. Esto garantiza que el bloqueo del lado de lectura no se suspenda y que varios lectores puedan adquirir el bloqueo simultáneamente, evitando contenciones innecesarias y posibles interbloqueos. El acceso de escritura se mantiene exclusivo, preservando la corrección. Este cambio resuelve las advertencias de lockdep sobre la posible suspensión en un contexto atómico."
    }
  ],
  "lastModified": "2026-06-17T09:16:45.463",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D",
              "versionEndExcluding": "6.12.37",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C",
              "versionEndExcluding": "6.15.6",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}