CVE-2025-40142

{
  "id": "CVE-2025-40142",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-11-12T11:15:44.017",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT\n\nsnd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts\nvia spin_lock_irq(). This also implicitly disables the handling of\nsoftirqs such as TIMER_SOFTIRQ.\nOn PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not\ndisable them. That means a timer can be invoked during spin_lock_irq()\non the same CPU. Due to synchronisations reasons local_bh_disable() has\na per-CPU lock named softirq_ctrl.lock which synchronizes individual\nsoftirq against each other.\nsyz-bot managed to trigger a lockdep report where softirq_ctrl.lock is\nacquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This\nis a possible deadlock.\n\nThe softirq_ctrl.lock can not be made part of spin_lock_irq() as this\nwould lead to too much synchronisation against individual threads on the\nsystem. To avoid the possible deadlock, softirqs must be manually\ndisabled before the lock is acquired.\n\nDisable softirqs before the lock is acquired on PREEMPT_RT."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: pcm: Deshabilitar softirqs inferiores como parte de spin_lock_irq() en PREEMPT_RT\n\nsnd_pcm_group_lock_irq() adquiere un spinlock_t y deshabilita las interrupciones a través de spin_lock_irq(). Esto también deshabilita implícitamente el manejo de softirqs como TIMER_SOFTIRQ.\nEn PREEMPT_RT, los softirqs son preemptibles y spin_lock_irq() no los deshabilita. Eso significa que se puede invocar un temporizador durante spin_lock_irq() en la misma CPU. Debido a razones de sincronización, local_bh_disable() tiene un bloqueo por CPU llamado softirq_ctrl.lock que sincroniza los softirqs individuales entre sí.\nsyz-bot logró activar un informe de lockdep donde softirq_ctrl.lock se adquiere en hrtimer_cancel() además de hrtimer_run_softirq(). Esto es un posible interbloqueo.\n\nEl softirq_ctrl.lock no puede formar parte de spin_lock_irq(), ya que esto llevaría a demasiada sincronización contra hilos individuales en el sistema. Para evitar el posible interbloqueo, los softirqs deben deshabilitarse manualmente antes de que se adquiera el bloqueo.\n\nDeshabilitar los softirqs antes de que se adquiera el bloqueo en PREEMPT_RT."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "d2d6422f8bd17c6bb205133e290625a564194496",
              "lessThan": "63ee96c7f47df239ee0a6e8108b6bfd8c98334ae",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d2d6422f8bd17c6bb205133e290625a564194496",
              "lessThan": "3969b6193cb7a45aa5fb4ec68f215e9e7f93d39a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d2d6422f8bd17c6bb205133e290625a564194496",
              "lessThan": "9fc4a3da9a0259a0500848b5d8657918efde176b",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.53",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.3",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3969b6193cb7a45aa5fb4ec68f215e9e7f93d39a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/63ee96c7f47df239ee0a6e8108b6bfd8c98334ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9fc4a3da9a0259a0500848b5d8657918efde176b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}