CVE-2025-71132: smc91x: fix broken irq-context in PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved:
smc91x: fix broken irq-context in PREEMPTRT
When smc91x.c is built with PREEMPTRT, the following splat occurs in FVPRevC:
[ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mldifcwork [ 13.062266] C replaying previous printk message [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mldifcwork [ 13.062469] Call trace: [ 13.062494] showstack+0x24/0x40 (C) [ 13.062602] dumpstack+0x28/0x48 [ 13.062710] dumpstacklvl+0x7c/0xb0 [ 13.062818] dumpstack+0x18/0x34 [ 13.062926] processscheduledworks+0x294/0x450 [ 13.063043] workerthread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] retfromfork+0x10/0x20
This happens because smcspecialtrylock() disables IRQs even on PREEMPTRT, but smcspecialunlock() does not restore IRQs on PREEMPTRT. The reason is that smcspecialunlock() calls spinunlockirqrestore(), and rcureadunlockbh() in devqueuexmit() cannot invoke rcureadunlock() through localbhenableip() when current->softirqdisablecnt becomes zero.
To address this issue, replace smcspecialtrylock() with spintrylockirqsave().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In smc91x.c, replace smc_special_trylock() with spin_trylock_irqsave() to preserve IRQ context on PREEMPT_RT.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71132?
CVE-2025-71132 is a medium severity vulnerability that affects the smc91x driver when built with PREEMPT_RT.
How does CVE-2025-71132 affect system performance?
CVE-2025-71132 can lead to unexpected behavior and instability in systems due to a broken IRQ context.
How do I fix CVE-2025-71132?
To fix CVE-2025-71132, you need to update the Linux kernel to a version that includes the patch for this vulnerability.
Which systems are affected by CVE-2025-71132?
CVE-2025-71132 affects Linux systems running the smc91x network driver built with the PREEMPT_RT configuration.
What does PREEMPT_RT mean in the context of CVE-2025-71132?
PREEMPT_RT refers to a real-time patch for the Linux kernel that improves responsiveness, which is impacted by this vulnerability.