CVE-2025-38374
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38374
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38374.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-38374
- Downstream
- Published
- 2025-07-25T12:53:16Z
- Modified
- 2025-10-22T13:50:57.952945Z
- Summary
- optee: ffa: fix sleep in atomic context
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
optee: ffa: fix sleep in atomic context
The OP-TEE driver registers the function notif_callback() for FF-A notifications. However, this function is called in an atomic context leading to errors like this when processing asynchronous notifications:
| BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258 | inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 9, name: kworker/0:0 | preemptcount: 1, expected: 0 | RCU nest depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0-00019-g657536ebe0aa #13 | Hardware name: linux,dummy-virt (DT) | Workqueue: ffapcpuirqnotification notifpcpuirqworkfn | Call trace: | showstack+0x18/0x24 (C) | dumpstacklvl+0x78/0x90 | dumpstack+0x18/0x24 | _mightresched+0x114/0x170 | _mightsleep+0x48/0x98 | mutexlock+0x24/0x80 | opteegetmsgarg+0x7c/0x21c | simplecallwitharg+0x50/0xc0 | opteedobottomhalf+0x14/0x20 | notifcallback+0x3c/0x48 | handlenotifcallbacks+0x9c/0xe0 | notifgetandhandle+0x40/0x88 | genericexecsingle+0x80/0xc0 | smpcallfunctionsingle+0xfc/0x1a0 | notifpcpuirqworkfn+0x2c/0x38 | processonework+0x14c/0x2b4 | workerthread+0x2e4/0x3e0 | kthread+0x13c/0x210 | retfrom_fork+0x10/0x20
Fix this by adding work queue to process the notification in a non-atomic context.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd0476a59de064205f4aaa8f7c6d6f32bc28a44d4Fixed5f28563f0c6862c99eb115c918421d9b73f137ad
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd0476a59de064205f4aaa8f7c6d6f32bc28a44d4Fixedf27cf15783bd60063c6c97434cbd67ebd91d8db5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd0476a59de064205f4aaa8f7c6d6f32bc28a44d4Fixed312d02adb959ea199372f375ada06e0186f651e4