CVE-2025-38388 (GCVE-0-2025-38388)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-05-11 21:27
VLAI
Title
firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context The current use of a mutex to protect the notifier hashtable accesses can lead to issues in the atomic context. It results in the below kernel warnings: | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4 | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Call trace: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | handle_notif_callbacks+0x54/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | worker_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20 To address this, replace the mutex with an rwlock to protect the notifier hashtable accesses. This ensures that read-side locking does not sleep and multiple readers can acquire the lock concurrently, avoiding unnecessary contention and potential deadlocks. Writer access remains exclusive, preserving correctness. This change resolves warnings from lockdep about potential sleep in atomic context.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e0573444edbf4ee7e3c191d3d08a4ccbd26628be , < 31405510a48dcf054abfa5b7b8d70ce1b27d1f13 (git)
Affected: e0573444edbf4ee7e3c191d3d08a4ccbd26628be , < 8986f8f61b482c0e6efd28f0b2423d9640c20eb1 (git)
Affected: e0573444edbf4ee7e3c191d3d08a4ccbd26628be , < 9ca7a421229bbdfbe2e1e628cff5cfa782720a10 (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_ffa/driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31405510a48dcf054abfa5b7b8d70ce1b27d1f13",
              "status": "affected",
              "version": "e0573444edbf4ee7e3c191d3d08a4ccbd26628be",
              "versionType": "git"
            },
            {
              "lessThan": "8986f8f61b482c0e6efd28f0b2423d9640c20eb1",
              "status": "affected",
              "version": "e0573444edbf4ee7e3c191d3d08a4ccbd26628be",
              "versionType": "git"
            },
            {
              "lessThan": "9ca7a421229bbdfbe2e1e628cff5cfa782720a10",
              "status": "affected",
              "version": "e0573444edbf4ee7e3c191d3d08a4ccbd26628be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_ffa/driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context\n\nThe current use of a mutex to protect the notifier hashtable accesses\ncan lead to issues in the atomic context. It results in the below\nkernel warnings:\n\n  |  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258\n  |  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0\n  |  preempt_count: 1, expected: 0\n  |  RCU nest depth: 0, expected: 0\n  |  CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4\n  |  Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn\n  |  Call trace:\n  |   show_stack+0x18/0x24 (C)\n  |   dump_stack_lvl+0x78/0x90\n  |   dump_stack+0x18/0x24\n  |   __might_resched+0x114/0x170\n  |   __might_sleep+0x48/0x98\n  |   mutex_lock+0x24/0x80\n  |   handle_notif_callbacks+0x54/0xe0\n  |   notif_get_and_handle+0x40/0x88\n  |   generic_exec_single+0x80/0xc0\n  |   smp_call_function_single+0xfc/0x1a0\n  |   notif_pcpu_irq_work_fn+0x2c/0x38\n  |   process_one_work+0x14c/0x2b4\n  |   worker_thread+0x2e4/0x3e0\n  |   kthread+0x13c/0x210\n  |   ret_from_fork+0x10/0x20\n\nTo address this, replace the mutex with an rwlock to protect the notifier\nhashtable accesses. This ensures that read-side locking does not sleep and\nmultiple readers can acquire the lock concurrently, avoiding unnecessary\ncontention and potential deadlocks. Writer access remains exclusive,\npreserving correctness.\n\nThis change resolves warnings from lockdep about potential sleep in\natomic context."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:01.121Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31405510a48dcf054abfa5b7b8d70ce1b27d1f13"
        },
        {
          "url": "https://git.kernel.org/stable/c/8986f8f61b482c0e6efd28f0b2423d9640c20eb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ca7a421229bbdfbe2e1e628cff5cfa782720a10"
        }
      ],
      "title": "firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38388",
    "datePublished": "2025-07-25T12:53:28.655Z",
    "dateReserved": "2025-04-16T04:51:24.011Z",
    "dateUpdated": "2026-05-11T21:27:01.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38388",
      "date": "2026-06-06",
      "epss": "0.00038",
      "percentile": "0.11738"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38388\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:28.127\",\"lastModified\":\"2025-11-19T20:10:28.510\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context\\n\\nThe current use of a mutex to protect the notifier hashtable accesses\\ncan lead to issues in the atomic context. It results in the below\\nkernel warnings:\\n\\n  |  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258\\n  |  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0\\n  |  preempt_count: 1, expected: 0\\n  |  RCU nest depth: 0, expected: 0\\n  |  CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4\\n  |  Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn\\n  |  Call trace:\\n  |   show_stack+0x18/0x24 (C)\\n  |   dump_stack_lvl+0x78/0x90\\n  |   dump_stack+0x18/0x24\\n  |   __might_resched+0x114/0x170\\n  |   __might_sleep+0x48/0x98\\n  |   mutex_lock+0x24/0x80\\n  |   handle_notif_callbacks+0x54/0xe0\\n  |   notif_get_and_handle+0x40/0x88\\n  |   generic_exec_single+0x80/0xc0\\n  |   smp_call_function_single+0xfc/0x1a0\\n  |   notif_pcpu_irq_work_fn+0x2c/0x38\\n  |   process_one_work+0x14c/0x2b4\\n  |   worker_thread+0x2e4/0x3e0\\n  |   kthread+0x13c/0x210\\n  |   ret_from_fork+0x10/0x20\\n\\nTo address this, replace the mutex with an rwlock to protect the notifier\\nhashtable accesses. This ensures that read-side locking does not sleep and\\nmultiple readers can acquire the lock concurrently, avoiding unnecessary\\ncontention and potential deadlocks. Writer access remains exclusive,\\npreserving correctness.\\n\\nThis change resolves warnings from lockdep about potential sleep in\\natomic context.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_ffa: Reemplazar mutex por rwlock para evitar la suspensi\u00f3n en contexto at\u00f3mico El uso actual de un mutex para proteger los accesos a la tabla hash del notificador puede provocar problemas en el contexto at\u00f3mico. Esto da como resultado las siguientes advertencias del kernel: | BUG: funci\u00f3n de suspensi\u00f3n llamada desde un contexto no v\u00e1lido en kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest Depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 No contaminado 6.14.0 #4 | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Rastreo de llamadas: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | handle_notif_callbacks+0x54/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | work_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20 Para solucionar esto, reemplace el mutex con un rwlock para proteger los accesos a la tabla hash del notificador. Esto garantiza que el bloqueo del lado de lectura no se suspenda y que varios lectores puedan adquirir el bloqueo simult\u00e1neamente, evitando contenciones innecesarias y posibles interbloqueos. El acceso de escritura se mantiene exclusivo, preservando la correcci\u00f3n. Este cambio resuelve las advertencias de lockdep sobre la posible suspensi\u00f3n en un contexto at\u00f3mico.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.37\",\"matchCriteriaId\":\"6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.6\",\"matchCriteriaId\":\"6E0BB4E0-44BC-4645-83A8-6EA232CE624C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/31405510a48dcf054abfa5b7b8d70ce1b27d1f13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8986f8f61b482c0e6efd28f0b2423d9640c20eb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ca7a421229bbdfbe2e1e628cff5cfa782720a10\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.