Listen to this Post
This vulnerability occurs in the Linux kernel’s `gpio-keys` input driver when the `PREEMPT_RT` (Real-Time) patch is enabled. Under standard kernel configuration, the `gpio_keys_irq_timer()` callback function executes in a standard interrupt context. However, with PREEMPT_RT, this same callback is forced to run in a hard IRQ (interrupt request) context, which is an atomic context where the kernel code cannot sleep or perform operations that may block. The problem arises when this function calls input_event(), which internally acquires a spinlock for synchronization. Under the `PREEMPT_RT` kernel, this spinlock is converted into a real-time mutex (rt_spin_lock) that is allowed to sleep. Therefore, attempting to acquire this sleeping lock from an atomic, non-sleeping hard IRQ context violates kernel rules, leading to a “sleeping function called from invalid context” error and causing a kernel panic (system crash). The fix involved relaxing the constraints of the associated high-resolution timer (hrtimer) so it does not execute its callback in the hard IRQ context, thereby avoiding the illegal locking scenario.
Platform: Linux Kernel
Version: All (PREEMPT_RT)
Vulnerability: Sleep-while-atomic
Severity: Medium
date: 2025-07-10
Prediction: Already patched
What Undercode Say:
$ uname -r 6.11.0-rt1 $ grep CONFIG_PREEMPT_RT /boot/config-$(uname -r) CONFIG_PREEMPT_RT=y $ dmesg | tail -20 [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78
How Exploit:
Trigger GPIO key interrupts on a `PREEMPT_RT` kernel to cause kernel panic.
Protection from this CVE
Apply kernel patch.
Impact:
Kernel panic, DoS.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
