CVE-2025-38335

What it actually does

The vulnerability causes gpio_keys_irq_timer() to invoke input_event() from hard IRQ context under PREEMPT_RT, where input_event() acquires an rt_spin_lock that is not permitted in atomic context, triggering a sleeping-function BUG.

Why it matters to the business

Kernel panics on real-time Linux systems using gpio-keys can cause unplanned downtime, loss of control in embedded or industrial devices, and require manual intervention or reboot, increasing operational risk until patches are applied.

How an attack unfolds

An attacker or workload triggers a gpio-keys IRQ that arms the hrtimer; when the timer fires in hard-IRQ context the callback calls input_event, which attempts the disallowed rt_spin_lock and panics the kernel. No remote code execution is involved; the impact is denial-of-service via crash.

How to fix it

Upgrade linux-lts to 6.1.81-r0, 6.6.58-r0 or 6.12.41-r0, or apply commit 664e5a6f541ff226621487d1280d2ec28e86be28 from the stable GIT tree. Rebuild and reboot with the fixed kernel; test gpio-keys under PREEMPT_RT after deployment.

How to confirm the fix worked

Confirm the running kernel contains commit 664e5a6f541ff or reports version 6.1.81-r0 / 6.6.58-r0 / 6.12.41-r0; exercise gpio-keys IRQ paths while PREEMPT_RT is active and verify absence of the 'sleeping function called from invalid context' BUG.

Typical attack path

1. Enable PREEMPT_RT and gpio-keys on the target kernel
2. Generate a gpio-keys interrupt that schedules the hrtimer
3. Timer callback executes in hard-IRQ context and calls input_event
4. rt_spin_lock inside input_event detects invalid sleep and panics

How to detect it

Search kernel logs and dmesg for the exact BUG string mentioning spinlock_rt.c together with gpio_keys_irq_timer and rt_spin_lock stack frames; correlate with hrtimer_interrupt entries around the panic timestamp.

• BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
• gpio_keys_irq_timer+0x4c/0x78
• rt_spin_lock+0x54/0x11c
• input_event+0x48/0x80

What your security team should do

• Apply the listed fixed kernel versions immediately on any PREEMPT_RT deployments
• Add kernel oops and BUG monitoring for spinlock_rt and gpio_keys_irq_timer strings
• Validate gpio-keys functionality in staging environments before production rollout
• Review downstream package dependencies for affected linux-lts builds