5.5

CVE-2025-38335: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT

Analyzed
AliasesUBUNTU-CVE-2025-38335DEBIAN-CVE-2025-38335
Published 10-07-2025Last modified 11-05-2026

Vulnerability summary

CVE-2025-38335 is a medium (CVSS 5.5) Improper Locking vulnerability in debian debian_linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.14%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 49 · Related 47
DLA-4328-1DSA-5975-1OPENSUSE-SU-2025:20081-1SUSE-SU-2025:02853-1SUSE-SU-2025:02923-1SUSE-SU-2025:02969-1

Timeline

  1. 10-07-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu135 products
  • linux< 5.15.0-163.173 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1097.104 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.148-1 | < 6.12.41-1 | < 6.16.3-1
  • debian_linuxEOL11.0
Linux2 products
  • linux≥ 019002f20cb5b9f78d39360aff244265d035e08a, < 664e5a6f541ff226621487d1280d2ec28e86be28 | ≥ 019002f20cb5b9f78d39360aff244265d035e08a, < a8f01e51109f77229e426b57c5d19251b462c6aa | ≥ 019002f20cb5b9f78d39360aff244265d035e08a, < fa53beab4740c4e5fe969f218a379f9558be33dc | ≥ 019002f20cb5b9f78d39360aff244265d035e08a, < a7b79db25846459de63ca8974268f0c41c734c4b | ≥ 019002f20cb5b9f78d39360aff244265d035e08a, < ec8f5da79b425deef5aebacdd4fe645620cd4f0b | ≥ 019002f20cb5b9f78d39360aff244265d035e08a, < f4a8f561d08e39f7833d4a278ebfb12a41eef15f | 5.13
  • linux_kernel≥ 5.13, < 5.15.190 | ≥ 5.16, < 6.1.148 | ≥ 6.2, < 6.6.101 | ≥ 6.7, < 6.12.41 | ≥ 6.13, < 6.15.4

3 vendors · 139 products

References

43 links
Show all 43 references