CVE-2025-40142
- Source
- https://cve.org/CVERecord?id=CVE-2025-40142
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40142.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-40142
- Downstream
- Published
- 2025-11-12T10:23:25.191Z
- Modified
- 2025-12-05T10:23:42.371280Z
- Summary
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Disable bottom softirqs as part of spinlockirq() on PREEMPT_RT
sndpcmgrouplockirq() acquires a spinlockt and disables interrupts via spinlockirq(). This also implicitly disables the handling of softirqs such as TIMERSOFTIRQ. On PREEMPTRT softirqs are preemptible and spinlockirq() does not disable them. That means a timer can be invoked during spinlockirq() on the same CPU. Due to synchronisations reasons localbhdisable() has a per-CPU lock named softirqctrl.lock which synchronizes individual softirq against each other. syz-bot managed to trigger a lockdep report where softirqctrl.lock is acquired in hrtimercancel() in addition to hrtimerrunsoftirq(). This is a possible deadlock.
The softirqctrl.lock can not be made part of spinlock_irq() as this would lead to too much synchronisation against individual threads on the system. To avoid the possible deadlock, softirqs must be manually disabled before the lock is acquired.
Disable softirqs before the lock is acquired on PREEMPT_RT.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40142.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/3969b6193cb7a45aa5fb4ec68f215e9e7f93d39a
- https://git.kernel.org/stable/c/63ee96c7f47df239ee0a6e8108b6bfd8c98334ae
- https://git.kernel.org/stable/c/9fc4a3da9a0259a0500848b5d8657918efde176b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40142.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40142
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd2d6422f8bd17c6bb205133e290625a564194496Fixed63ee96c7f47df239ee0a6e8108b6bfd8c98334aeFixed3969b6193cb7a45aa5fb4ec68f215e9e7f93d39aFixed9fc4a3da9a0259a0500848b5d8657918efde176b