UBUNTU-CVE-2025-38335: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-azure-fde, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-gkeop, ubuntu/linux-riscv, ubuntu/linux-aws-fips.

Q: What conditions are associated with exposure?

The issue is associated with kernels running PREEMPT_RT and the gpio-keys path, where the gpio_keys_irq_timer() callback can execute in hard IRQ context. Systems not using PREEMPT_RT are not identified in the provided data as having this condition.

Q: What level of access does exploitation require and what is the expected impact?

The supplied CVSS vector indicates local access and low privileges are required, with no user interaction. It indicates high availability impact, while confidentiality and integrity impact are marked as none.

Q: How can administrators recognize the reported failure?

The provided trace shows a “BUG: sleeping function called from invalid context” message at kernel/locking/spinlock_rt.c:48. Relevant stack frames include rt_spin_lock(), input_event(), gpio_keys_irq_timer(), __hrtimer_run_queues(), and hrtimer_interrupt().

Published Jul 10, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - fix a sleep while atomic with PREEMPTRT When enabling PREEMPTRT, the gpiokeysirqtimer() callback runs in hard irq context, but the inputevent() takes a spinlock, which isn't allowed there as it is converted to a rtspinlock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlockrt.c:48 [ 4054.290028] inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 0, name: swapper/0 ... [ 4054.290195] mightresched+0x13c/0x1f4 [ 4054.290209] rtspinlock+0x54/0x11c [ 4054.290219] inputevent+0x48/0x80 [ 4054.290230] gpiokeysirqtimer+0x4c/0x78 [ 4054.290243] hrtimerrunqueues+0x1a4/0x438 [ 4054.290257] hrtimerinterrupt+0xe4/0x240 [ 4054.290269] archtimerhandlerphys+0x2c/0x44 [ 4054.290283] handlepercpudevidirq+0x8c/0x14c [ 4054.290297] handleirqdesc+0x40/0x58 [ 4054.290307] generichandledomainirq+0x1c/0x28 [ 4054.290316] gichandleirq+0x44/0xcc Considering the gpiokeysirqisr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context.

Affected Software

171 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1097.104~20.04.1

5.15.0-1097.104~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1102.111~20.04.1

5.15.0-1102.111~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1097.106~20.04.1

5.15.0-1097.106~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-163.173~20.04.1

5.15.0-163.173~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15<5.15.0-1091.94~20.04.1

5.15.0-1091.94~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1092.98~20.04.1

5.15.0-1092.98~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-163.173~20.04.1

5.15.0-163.173~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1049.49~20.04.1

5.15.0-1049.49~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1094.100~20.04.1

5.15.0-1094.100~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1092.96~20.04.1

5.15.0-1092.96~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-163.173

5.15.0-163.173

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1097.104

5.15.0-1097.104

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-azure<5.15.0-1101.110

5.15.0-1101.110

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1

6.8.0-1051.57~22.04.1

ubuntu/linux-azure-fde<5.15.0-1102.111.1

5.15.0-1102.111.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1046.53~22.04.1

6.8.0-1046.53~22.04.1

ubuntu/linux-gcp<5.15.0-1097.106

5.15.0-1097.106

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1047.50~22.04.2

6.8.0-1047.50~22.04.2

ubuntu/linux-gke<5.15.0-1093.99

5.15.0-1093.99

ubuntu/linux-gkeop<5.15.0-1080.88

5.15.0-1080.88

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-ibm<5.15.0-1091.94

5.15.0-1091.94

ubuntu/linux-ibm-6.8<6.8.0-1044.44~22.04.1

6.8.0-1044.44~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1092.98

5.15.0-1092.98

ubuntu/linux-kvm<5.15.0-1089.94

5.15.0-1089.94

ubuntu/linux-lowlatency<5.15.0-163.173

5.15.0-163.173

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-100.100.1~22.04.1

6.8.0-100.100.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1092.93

5.15.0-1092.93

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1049.49

5.15.0-1049.49

ubuntu/linux-nvidia-tegra-igx<5.15.0-1038.38

5.15.0-1038.38

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1094.100

5.15.0-1094.100

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1043.44~22.04.1

6.8.0-1043.44~22.04.1

ubuntu/linux-raspi<5.15.0-1091.94

5.15.0-1091.94

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1061.65

5.15.0-1061.65

ubuntu/linux-bluefield<5.15.0-1081.83

5.15.0-1081.83

ubuntu/linux-intel-iot-realtime<5.15.0-1089.91

5.15.0-1089.91

ubuntu/linux-realtime<5.15.0-1096.105

5.15.0-1096.105

ubuntu/linux-realtime-6.8<6.8.1-1041.42~22.04.1

6.8.1-1041.42~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1097.104+fips1

5.15.0-1097.104+fips1

ubuntu/linux-azure-fips<5.15.0-1101.110+fips1

5.15.0-1101.110+fips1

ubuntu/linux-fips<5.15.0-163.173+fips1

5.15.0-163.173+fips1

ubuntu/linux-gcp-fips<5.15.0-1097.106+fips1

5.15.0-1097.106+fips1

ubuntu/linux<6.8.0-100.100

6.8.0-100.100

ubuntu/linux-aws<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-aws-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure<6.8.0-1046.52

6.8.0-1046.52

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-fde<6.8.0-1046.53

6.8.0-1046.53

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia<6.8.0-1039.42

6.8.0-1039.42

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1047.50

6.8.0-1047.50

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1020.21~24.04.1

6.14.0-1020.21~24.04.1

ubuntu/linux-gke<6.8.0-1043.48

6.8.0-1043.48

ubuntu/linux-gkeop<6.8.0-1030.33

6.8.0-1030.33

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm<6.8.0-1044.44

6.8.0-1044.44

ubuntu/linux-intel*

ubuntu/linux-lowlatency<6.8.0-100.100.1

6.8.0-100.100.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency<6.8.0-1046.49.1

6.8.0-1046.49.1

ubuntu/linux-nvidia-tegra<6.8.0-1020.20

6.8.0-1020.20

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1016.16

6.14.0-1016.16

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1043.44

6.8.0-1043.44

ubuntu/linux-oracle-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-raspi<6.8.0-1047.51

6.8.0-1047.51

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-36.36.1~24.04.1

6.14.0-36.36.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1023.24

6.8.0-1023.24

ubuntu/linux-bluefield<6.8.0-1016.20

6.8.0-1016.20

ubuntu/linux-raspi-realtime<6.8.0-2037.38

6.8.0-2037.38

ubuntu/linux-realtime<6.8.1-1041.42

6.8.1-1041.42

ubuntu/linux-realtime-6.14<6.14.0-1016.16~24.04.1

6.14.0-1016.16~24.04.1

ubuntu/linux-aws-fips<6.8.0-1046.49+fips1

6.8.0-1046.49+fips1

ubuntu/linux-azure-fips<6.8.0-1046.52+fips1

6.8.0-1046.52+fips1

ubuntu/linux-fips<6.8.0-100.100+fips1

6.8.0-100.100+fips1

ubuntu/linux-gcp-fips<6.8.0-1047.50+fips1

6.8.0-1047.50+fips1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.104~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.106~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-163.173~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1091.94~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.98~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-163.173~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.49~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.100~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.96~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-163.173
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.104
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1101.110
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.106
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50~22.04.2
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1093.99
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.88
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1091.94
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.98
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.94
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-163.173
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.93
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.49
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1038.38
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.100
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1091.94
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1061.65
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.83
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.91
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.104+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1101.110+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-163.173+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.106+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.42
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1020.21~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.48
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.33
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.20
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.51
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-36.36.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.24
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1016.20
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2037.38
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50+fips1
Configuration
Relax the gpio_keys_irq_timer() hrtimer so it does not run in hard IRQ context, allowing input_event() to acquire the PREEMPT_RT-converted rt_spin_lock().
Linux kernel gpio-keys hrtimer execution context = non-hard IRQ context

Event History

Jul 10, 2025

CVE Published

via OSV·09:15 AM

Data Sourced

via OSV·09:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-azure-fde, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-gkeop, ubuntu/linux-riscv, ubuntu/linux-aws-fips.

What conditions are associated with exposure?

The issue is associated with kernels running PREEMPT_RT and the gpio-keys path, where the gpio_keys_irq_timer() callback can execute in hard IRQ context. Systems not using PREEMPT_RT are not identified in the provided data as having this condition.

What level of access does exploitation require and what is the expected impact?

The supplied CVSS vector indicates local access and low privileges are required, with no user interaction. It indicates high availability impact, while confidentiality and integrity impact are marked as none.

How can administrators recognize the reported failure?

The provided trace shows a “BUG: sleeping function called from invalid context” message at kernel/locking/spinlock_rt.c:48. Relevant stack frames include rt_spin_lock(), input_event(), gpio_keys_irq_timer(), __hrtimer_run_queues(), and hrtimer_interrupt().

UBUNTU-CVE-2025-38335: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What conditions are associated with exposure?

What level of access does exploitation require and what is the expected impact?

How can administrators recognize the reported failure?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What conditions are associated with exposure?

What level of access does exploitation require and what is the expected impact?

How can administrators recognize the reported failure?