CVE-2026-80562 - Vulnerability Details

- gpio: ml-ioh: use raw_spinlock_t for the register lock

Description

In the Linux kernel, the following vulnerability has been resolved:

gpio: ml-ioh: use raw_spinlock_t for the register lock

ioh_irq_type() is registered as the irq_chip .irq_set_type callback and
takes chip->spinlock with spin_lock_irqsave(). This callback is reached
from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while
the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.
That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is
an rtmutex-backed sleeping lock, so acquiring it there is invalid.
ioh_irq_enable() and ioh_irq_disable() take the same lock from the
.irq_enable/.irq_disable callbacks, which are likewise invoked with
desc->lock held.

Convert the register lock to raw_spinlock_t. The same lock also
serializes the GPIO direction/value callbacks and the suspend/resume
register save/restore, and those critical sections only perform short
sequences of MMIO register accesses (ioread32()/iowrite32()); the
.irq_set_type callback additionally emits a dev_warn() on an unsupported
type. None of these are sleepable operations, so keeping this register
lock non-sleeping is appropriate for the irqchip callbacks and does not
change the GPIO-side locking contract.

This is the same fix as commit a02b8950d619 ("gpio: pch: use
raw_spinlock_t for the register lock"); this driver shares the same
structure as gpio-pch.

Published: 2026-08-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability stems from the ml-ioh GPIO driver using a regular spinlock_t, which under PREEMPT_RT is an rtmutex-backed sleeping lock, within interrupt-handling callbacks that are required to be non-sleepable. This misuse can lead to a deadlock or system hang when the lock is acquired while hard interrupts are disabled, but it does not provide a direct path for remote code execution or privilege escalation.

Affected Systems

Affected systems are Linux kernel installations that include the ml-ioh GPIO driver prior to the applied fix. The vendor is Linux, kernel product, all versions that deploy this driver before the patch commit a02b8950d619.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a moderate but low exploitation probability. The issue is not listed in CISA’s KEV catalog. The risk remains low to moderate: the flaw could cause unstable behavior or a hang in a system running the REALTIME patch level, but it requires local kernel execution with the specific driver present and is unlikely to be remotely exploitable. No known workaround is provided beyond updating the kernel.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< 431b10133113537660a6090a2856b0d74d1b06de
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< 359e6b1168c9a62a7bd214ace476aaa2d57eebe8
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< 63d2230e5076c12f93d2a1d1bff2fbbf6cf32f3c
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< b6505a4cea45dd92eb753581b1ad9b524b5fcc34
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< 84be002b40d30c56a91873b236e2d9001bbee363
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< bc7934d0acd4fc1c7e5b7c68debdb4a991121628
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< 0559b86611c35d342dd48542ea26a9e437046bf6
`54be566317b6aece2389a95bb19ea209af9359be`	affected	< 600411ea1f2443fdf5b1af9b6480f616d7aff9d0

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[54be566317b6aece2389a95bb19ea209af9359be,bc7934d0acd4fc1c7e5b7c68debdb4a991121628)`	affected	code_commit	—
`[54be566317b6aece2389a95bb19ea209af9359be,0559b86611c35d342dd48542ea26a9e437046bf6)`	affected	code_commit	—
`[54be566317b6aece2389a95bb19ea209af9359be,600411ea1f2443fdf5b1af9b6480f616d7aff9d0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.2`	affected	generic	—
`[0,3.2)`	unaffected	generic	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes commit a02b8950d619, which replaces the sleepable spinlock with a non-sleeping raw_spinlock_t in the ml-ioh driver
If an immediate kernel upgrade is not possible, restrict use of the PREEMPT_RT configuration or disable the ml-ioh driver to avoid the context where the sleeping lock could be acquired
Apply a temporary compile-time patch by replacing the spinlock_t in ml-ioh driver callback code with raw_spinlock_t, then rebuild the kernel until the official patch is installed

Generated by OpenCVE AI on August 28, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6477-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0559b86611c35d342dd48542ea26a9e437046bf6
https://git.kernel.org/stable/c/359e6b1168c9a62a7bd214ace476aaa2d57eebe8
https://git.kernel.org/stable/c/431b10133113537660a6090a2856b0d74d1b06de
https://git.kernel.org/stable/c/600411ea1f2443fdf5b1af9b6480f616d7aff9d0
https://git.kernel.org/stable/c/63d2230e5076c12f93d2a1d1bff2fbbf6cf32f3c
https://git.kernel.org/stable/c/84be002b40d30c56a91873b236e2d9001bbee363
https://git.kernel.org/stable/c/b6505a4cea45dd92eb753581b1ad9b524b5fcc34
https://git.kernel.org/stable/c/bc7934d0acd4fc1c7e5b7c68debdb4a991121628
https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80562-30aa@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80562
https://www.cve.org/CVERecord?id=CVE-2026-80562

History

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80562-30aa@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80562 https://www.cve.org/CVERecord?id=CVE-2026-80562
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 27 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/359e6b1168c9a62a7bd214ace476aaa2d57eebe8 https://git.kernel.org/stable/c/431b10133113537660a6090a2856b0d74d1b06de https://git.kernel.org/stable/c/63d2230e5076c12f93d2a1d1bff2fbbf6cf32f3c https://git.kernel.org/stable/c/84be002b40d30c56a91873b236e2d9001bbee363 https://git.kernel.org/stable/c/b6505a4cea45dd92eb753581b1ad9b524b5fcc34

Wed, 26 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-754

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use raw_spinlock_t for the register lock ioh_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip->spinlock with spin_lock_irqsave(). This callback is reached from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled. That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is an rtmutex-backed sleeping lock, so acquiring it there is invalid. ioh_irq_enable() and ioh_irq_disable() take the same lock from the .irq_enable/.irq_disable callbacks, which are likewise invoked with desc->lock held. Convert the register lock to raw_spinlock_t. The same lock also serializes the GPIO direction/value callbacks and the suspend/resume register save/restore, and those critical sections only perform short sequences of MMIO register accesses (ioread32()/iowrite32()); the .irq_set_type callback additionally emits a dev_warn() on an unsupported type. None of these are sleepable operations, so keeping this register lock non-sleeping is appropriate for the irqchip callbacks and does not change the GPIO-side locking contract. This is the same fix as commit a02b8950d619 ("gpio: pch: use raw_spinlock_t for the register lock"); this driver shares the same structure as gpio-pch.
Title		gpio: ml-ioh: use raw_spinlock_t for the register lock
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0559b86611c35d342dd48542ea26a9e437046bf6 https://git.kernel.org/stable/c/600411ea1f2443fdf5b1af9b6480f616d7aff9d0 https://git.kernel.org/stable/c/bc7934d0acd4fc1c7e5b7c68debdb4a991121628

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:27.171Z

Updated: 2026-08-27T12:40:17.967Z

Reserved: 2026-08-26T14:34:25.767Z

Link: CVE-2026-80562

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:11.183

Modified: 2026-08-27T13:18:40.533

Link: CVE-2026-80562

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80562 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T08:30:17Z

Weaknesses

CWE-754
Improper Check for Unusual or Exceptional Conditions
CWE-821
Incorrect Synchronization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object