CVE-2025-40142: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Disable bottom softirqs as part of spinlockirq() on PREEMPTRT
sndpcmgrouplockirq() acquires a spinlockt and disables interrupts via spinlockirq(). This also implicitly disables the handling of softirqs such as TIMERSOFTIRQ. On PREEMPTRT softirqs are preemptible and spinlockirq() does not disable them. That means a timer can be invoked during spinlockirq() on the same CPU. Due to synchronisations reasons localbhdisable() has a per-CPU lock named softirqctrl.lock which synchronizes individual softirq against each other. syz-bot managed to trigger a lockdep report where softirqctrl.lock is acquired in hrtimercancel() in addition to hrtimerrunsoftirq(). This is a possible deadlock.
The softirqctrl.lock can not be made part of spinlockirq() as this would lead to too much synchronisation against individual threads on the system. To avoid the possible deadlock, softirqs must be manually disabled before the lock is acquired.
Disable softirqs before the lock is acquired on PREEMPTRT.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
On PREEMPT_RT, manually disable softirqs before acquiring the lock in snd_pcm_group_lock_irq() to prevent softirqs such as TIMER_SOFTIRQ from running during spin_lock_irq() and avoid the deadlock.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40142?
CVE-2025-40142 has been categorized with a medium severity due to its impact on the proper functioning of ALSA in the Linux kernel.
How do I fix CVE-2025-40142?
To fix CVE-2025-40142, update to the latest version of the Linux kernel that contains the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-40142?
CVE-2025-40142 affects multiple versions of the Linux kernel prior to the release that includes the mitigation.
What components of the Linux kernel are impacted by CVE-2025-40142?
CVE-2025-40142 impacts the ALSA PCM subsystem related to softirqs and spinlocks.
Is CVE-2025-40142 exploited in the wild?
As of now, there are no public reports indicating that CVE-2025-40142 is actively exploited in the wild.