CVE-2025-38632
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38632
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38632.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38632
- Downstream
- Related
- Published
- 2025-08-22T16:00:40Z
- Modified
- 2025-10-18T06:02:35.696899Z
- Summary
- pinmux: fix race causing mux_owner NULL with active mux_usecount
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
pinmux: fix race causing muxowner NULL with active muxusecount
commit 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") tried to address the issue when two client of the same gpio calls pinctrlselectstate() for the same functionality, was resulting in NULL pointer issue while accessing desc->mux_owner. However, issue was not completely fixed due to the way it was handled and it can still result in the same NULL pointer.
The issue occurs due to the following interleaving:
cpu0 (process A) cpu1 (process B) pin_request() { pin_free() { mutex_lock() desc->mux_usecount--; //becomes 0 .. mutex_unlock()mutexlock(desc->mux) desc->muxusecount++; // becomes 1 desc->muxowner = owner; mutexunlock(desc->mux)
mutex_lock(desc->mux) desc->mux_owner = NULL; mutex_unlock(desc->mux)This sequence leads to a state where the pin appears to be in use (
mux_usecount == 1) but has no owner (mux_owner == NULL), which can cause NULL pointer on next pin_request on the same pin.Ensure that updates to muxusecount and muxowner are performed atomically under the same lock. Only clear muxowner when muxusecount reaches zero and no new owner has been assigned.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0b075c011032f88d1cfde3b45d6dcf08b44140eb
- https://git.kernel.org/stable/c/22b585cbd67d14df3b91529d1b990661c300faa9
- https://git.kernel.org/stable/c/9b2a3e7189028aa7c4d53a84364f2ea9fb209787
- https://git.kernel.org/stable/c/9ea3f6b9a67be3476e331ce51cac316c2614a564
- https://git.kernel.org/stable/c/b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2da32aed4a97ca1d70fb8b77926f72f30ce5fb4bFixed9b2a3e7189028aa7c4d53a84364f2ea9fb209787
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc11e2ec9a780f54982a187ee10ffd1b810715c85Fixed9ea3f6b9a67be3476e331ce51cac316c2614a564
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6eFixedb7bd6e3971eb7f0e34d2fdce1b18b08094e0c804
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6eFixed22b585cbd67d14df3b91529d1b990661c300faa9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6eFixed0b075c011032f88d1cfde3b45d6dcf08b44140eb
Affected versions
v6.*
Linux / Kernel
Package
- Name
- Kernel