CVE-2026-64428

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gpio: sch: use raw_spinlock_t in the irq startup path

sch_irq_unmask() enables the GPIO IRQ and then updates the controller

state through sch_irq_mask_unmask(), which takes sch->lock with

spin_lock_irqsave(). The callback can be reached from irq_startup()

while setting up a requested IRQ. That path is not sleepable, but on

PREEMPT_RT a regular spinlock_t becomes a sleeping lock.

This issue was found by our static analysis tool and then manually

reviewed against the current tree.

The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->

irq_startup() -> sch_irq_unmask() -> sch_irq_mask_unmask() carrier and

used the original spin_lock_irqsave(&sch->lock) edge. Lockdep reported:

BUG: sleeping function called from invalid context

hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]

sch_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]

sch_irq_mask_unmask.constprop.0+0x31/0x70 [vuln_msv]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References