Description
In the Linux kernel, the following vulnerability has been resolved:

gpio: ml-ioh: use raw_spinlock_t for the register lock

ioh_irq_type() is registered as the irq_chip .irq_set_type callback and
takes chip->spinlock with spin_lock_irqsave(). This callback is reached
from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while
the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.
That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is
an rtmutex-backed sleeping lock, so acquiring it there is invalid.
ioh_irq_enable() and ioh_irq_disable() take the same lock from the
.irq_enable/.irq_disable callbacks, which are likewise invoked with
desc->lock held.

Convert the register lock to raw_spinlock_t. The same lock also
serializes the GPIO direction/value callbacks and the suspend/resume
register save/restore, and those critical sections only perform short
sequences of MMIO register accesses (ioread32()/iowrite32()); the
.irq_set_type callback additionally emits a dev_warn() on an unsupported
type. None of these are sleepable operations, so keeping this register
lock non-sleeping is appropriate for the irqchip callbacks and does not
change the GPIO-side locking contract.

This is the same fix as commit a02b8950d619 ("gpio: pch: use
raw_spinlock_t for the register lock"); this driver shares the same
structure as gpio-pch.
Published: 2026-08-26
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from the ml-ioh GPIO driver using a regular spinlock_t, which under PREEMPT_RT is an rtmutex-backed sleeping lock, within interrupt-handling callbacks that are required to be non-sleepable. This misuse can lead to a deadlock or system hang when the lock is acquired while hard interrupts are disabled, but it does not provide a direct path for remote code execution or privilege escalation.

Affected Systems

Affected systems are Linux kernel installations that include the ml-ioh GPIO driver prior to the applied fix. The vendor is Linux, kernel product, all versions that deploy this driver before the patch commit a02b8950d619.

Risk and Exploitability

The CVSS score is not provided and the EPSS score is not available, indicating limited public exploitation data. The issue is listed as not being in CISA’s KEV catalog. The risk is therefore low to moderate: the flaw could cause unstable behavior or a hang in a system running the REALTIME patch level, but it requires local kernel execution with the specific driver present and is unlikely to be remotely exploitable. No known workaround is provided beyond updating the kernel.

Generated by OpenCVE AI on August 26, 2026 at 17:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes commit a02b8950d619, which replaces the sleepable spinlock with a non‑sleeping raw_spinlock_t in the ml‑ioh driver
  • If an immediate kernel upgrade is not possible, restrict use of the PREEMPT_RT configuration or disable the ml‑ioh driver to avoid the context where the sleeping lock could be acquired
  • Apply a temporary compile‑time patch by replacing the spinlock_t in ml‑ioh driver callback code with raw_spinlock_t, then rebuild the kernel until the official patch is installed

Generated by OpenCVE AI on August 26, 2026 at 17:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-754

Wed, 26 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use raw_spinlock_t for the register lock ioh_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip->spinlock with spin_lock_irqsave(). This callback is reached from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled. That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is an rtmutex-backed sleeping lock, so acquiring it there is invalid. ioh_irq_enable() and ioh_irq_disable() take the same lock from the .irq_enable/.irq_disable callbacks, which are likewise invoked with desc->lock held. Convert the register lock to raw_spinlock_t. The same lock also serializes the GPIO direction/value callbacks and the suspend/resume register save/restore, and those critical sections only perform short sequences of MMIO register accesses (ioread32()/iowrite32()); the .irq_set_type callback additionally emits a dev_warn() on an unsupported type. None of these are sleepable operations, so keeping this register lock non-sleeping is appropriate for the irqchip callbacks and does not change the GPIO-side locking contract. This is the same fix as commit a02b8950d619 ("gpio: pch: use raw_spinlock_t for the register lock"); this driver shares the same structure as gpio-pch.
Title gpio: ml-ioh: use raw_spinlock_t for the register lock
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-26T14:37:27.171Z

Reserved: 2026-08-26T14:34:25.767Z

Link: CVE-2026-80562

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T15:17:11.183

Modified: 2026-08-26T15:17:11.183

Link: CVE-2026-80562

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T18:00:04Z

Weaknesses
  • CWE-754

    Improper Check for Unusual or Exceptional Conditions