CVE-2025-23161

PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type

MEDIUM
5.5
CVSS Score
Published: May 1, 2025 at 12:55 PM UTC
Updated: June 17, 2026 at 08:52 AM UTC
2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type The access to the PCI config space via pci_ops::read and pci_ops::write is a low-level hardware access. The functions can be accessed with disabled interrupts even on PREEMPT_RT. The pci_lock is a raw_spinlock_t for this purpose. A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be acquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in the same context as the pci_lock. Make vmd_dev::cfg_lock a raw_spinlock_t type so it can be used with interrupts disabled. This was reported as: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 Call Trace: rt_spin_lock+0x4e/0x130 vmd_pci_read+0x8d/0x100 [vmd] pci_user_read_config_byte+0x6f/0xe0 pci_read_config+0xfe/0x290 sysfs_kf_bin_read+0x68/0x90 [bigeasy: reword commit message] Tested-off-by: Luis Claudio R. Goncalves <[email protected]> [kwilczynski: commit log] [bhelgaas: add back report info from https://lore.kernel.org/lkml/[email protected]/]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 5.15.1814.5 ≤ v < 5.15.1814.5 ≤ v < 6.1.1354.5 ≤ v < 6.12.244.5 ≤ v < 6.13.124.5 ≤ v < 6.14.34.5 ≤ v < 6.154.5 ≤ v < 6.6.885.16 ≤ v < 6.1.1356.13 ≤ v < 6.13.126.14 ≤ v < 6.14.36.2 ≤ v < 6.6.886.7 ≤ v < 6.12.24185a383ada2e7794b0e82e040223e741b24d2bf84.5
Vendor states this is fixed in 13e5148f70e81991acbe0bab5b1b50ba699116e7 (fixed)
Vendor states this is fixed in 18056a48669a040bef491e63b25896561ee14d90 (fixed)
Vendor states this is fixed in 20d0a9062c031068fa39f725a32f182b709b5525 (fixed)
Vendor states this is fixed in 2358046ead696ca5c7c628d6c0e2c6792619a3e5 (fixed)
Vendor states this is fixed in 5c3cfcf0b4bf43530788b08a8eaf7896ec567484 (fixed)
Vendor states this is fixed in c250262d6485ca333e9821f85b07eb383ec546b1 (fixed)
Vendor states this is fixed in c2968c812339593ac6e2bdd5cc3adabe3f05fa53 (fixed)
Vendor states this is fixed in 4.5 (unaffected)
Vendor states this is fixed in 5.15.181 (unaffected)
Vendor states this is fixed in 6.1.135 (unaffected)
Vendor states this is fixed in 6.12.24 (unaffected)
Vendor states this is fixed in 6.13.12 (unaffected)
Vendor states this is fixed in 6.14.3 (unaffected)
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.6.88 (unaffected)

References (8)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/13e5148f70e81991acbe0bab5b1b50ba699116e7
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/18056a48669a040bef491e63b25896561ee14d90
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/20d0a9062c031068fa39f725a32f182b709b5525
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2358046ead696ca5c7c628d6c0e2c6792619a3e5
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5c3cfcf0b4bf43530788b08a8eaf7896ec567484
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c250262d6485ca333e9821f85b07eb383ec546b1
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c2968c812339593ac6e2bdd5cc3adabe3f05fa53
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card