CVE-2026-64429

What the bug is

sprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller state through sprd_eic_update(), which takes sprd_eic->lock with spin_lock_irqsave(). The callback can be reached from irq_startup() while setting up a requested IRQ. That path is not sleepable, but on PREEMPT_RT a regular spinlock_t becomes a sleeping lock. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the request_threaded_irq() -> __setup_irq() -> irq_startup() -> sprd_eic_irq_unmask() -> sprd_eic_update() carrier and used the original spin_lock_irqsave(&sprd_eic->lock) edge. Lockdep BUG: sleeping function called from invalid context hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv] sprd_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv] sprd_eic_update.constprop.0+0x48/0x90 [vuln_msv] sprd_eic_irq_unmask.constprop.0+0x35/0x50 [vuln_msv] __setup_irq.constprop.0+0xd/0x30 [vuln_msv] Convert the Spreadtrum EIC controller lock to raw_spinlock_t. The locked section only serializes MMIO register updates and does not contain sleepable operations, so keeping it non-sleeping is appropriate for the irqchip callbacks.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/gpio/gpio-eic-sprd.c

What this is

GPIO SUBSYSTEMMAINTAINERS section matched on drivers/gpio/ · linux-gpio@vger.kernel.org · Maintained

Kernel module

none to look for. The file would have gone into gpio_eic_sprd, and Debian does not compile it into that module, so finding gpio_eic_sprd in lsmod would say nothing about this CVE.

Check it on the machine

grep -wE 'CONFIG_GPIOLIB|CONFIG_GPIO_EIC_SPRD' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.

• bookworm, trixie, forky, sid, bookworm · linux-6.12n

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_GPIOLIB, CONFIG_GPIO_EIC_SPRD

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-07-25 (3 months ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.10%, higher than 0.6% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/gpio

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.17	5.10.261	96612bf2712c
4.17	5.15.212	581ac2ad001f
4.17	6.1.178	e244cd8b5100
4.17	6.6.145	19d63fd52871
4.17	6.12.96	6112fba41500
4.17	6.18.39	4750909a40da
4.17	7.1.4	5c3c9ec1172a
4.17	7.2	90f0109019e6

Debian advisories