CVE-2026-74468

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: pch: use raw_spinlock_t for the register lock<br /> <br /> pch_irq_type() is registered as the irq_chip .irq_set_type callback and<br /> takes chip-&gt;spinlock with spin_lock_irqsave(). This callback is reached<br /> from __setup_irq() -&gt; __irq_set_trigger() -&gt; chip-&gt;irq_set_type() while<br /> the caller holds desc-&gt;lock, a raw_spinlock_t, with hardirqs disabled.<br /> That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is<br /> an rtmutex-backed sleeping lock, so acquiring it there is invalid.<br /> <br /> This was confirmed on a PREEMPT_RT kernel with lockdep<br /> (PROVE_RAW_LOCK_NESTING and DEBUG_ATOMIC_SLEEP). A grounded PoC mirrored<br /> pch_irq_type()&amp;#39;s locking and drove it through the real genirq carrier<br /> irq_set_irq_type() -&gt; __irq_set_trigger() -&gt; chip-&gt;irq_set_type(), i.e.<br /> the same __irq_set_trigger() edge that __setup_irq() takes for a<br /> requested IRQ. With the original spin_lock_irqsave() edge lockdep<br /> reported an invalid wait context, immediately followed by:<br /> <br /> BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48<br /> in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 95, name: insmod<br /> hardirqs last disabled at (3784): _raw_spin_lock_irqsave+0x4f/0x60<br /> rt_spin_lock+0x3a/0x1c0<br /> repro_irq_set_type+0x64/0xa0 [pch_repro]<br /> __irq_set_trigger+0x69/0x140<br /> irq_set_irq_type+0x78/0xd0<br /> <br /> Switching the mirrored lock to raw_spinlock_t made both splats go away.<br /> <br /> Convert the register lock to raw_spinlock_t. The same lock also<br /> serializes the GPIO direction/value callbacks and the suspend/resume<br /> register save/restore, but all of those critical sections only perform<br /> MMIO register accesses (ioread32()/iowrite32()) and<br /> irq_set_handler_locked(); none of them contain sleepable operations.<br /> Keeping this register lock non-sleeping is therefore appropriate for the<br /> irqchip callbacks and does not change the GPIO-side locking contract.<br /> <br /> This is the same class of issue and fix as recently addressed for other<br /> GPIO controllers, e.g. commit 286533cb14a3 ("gpio: sch: use raw_spinlock_t<br /> in the irq startup path") and commit 90f0109019e6 ("gpio: eic-sprd: use<br /> raw_spinlock_t in the irq startup path").