{"cve":"CVE-2026-74468","nvd":{"published":"2026-08-15T13:17:51.500","modified":"2026-08-19T17:21:03.810","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pch: use raw_spinlock_t for the register lock\n\npch_irq_type() is registered as the irq_chip .irq_set_type callback and\ntakes chip->spinlock with spin_lock_irqsave().  This callback is reached\nfrom __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while\nthe caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.\nThat context is not sleepable, but on PREEMPT_RT a regular spinlock_t is\nan rtmutex-backed sleeping lock, so acquiring it there is invalid.\n\nThis was confirmed on a PREEMPT_RT kernel with lockdep\n(PROVE_RAW_LOCK_NESTING and DEBUG_ATOMIC_SLEEP).  A grounded PoC mirrored\npch_irq_type()'s locking and drove it through the real genirq carrier\nirq_set_irq_type() -> __irq_set_trigger() -> chip->irq_set_type(), i.e.\nthe same __irq_set_trigger() edge that __setup_irq() takes for a\nrequested IRQ.  With the original spin_lock_irqsave() edge lockdep\nreported an invalid wait context, immediately followed by:\n\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 95, name: insmod\n  hardirqs last disabled at (3784): _raw_spin_lock_irqsave+0x4f/0x60\n   rt_spin_lock+0x3a/0x1c0\n   repro_irq_set_type+0x64/0xa0 [pch_repro]\n   __irq_set_trigger+0x69/0x140\n   irq_set_irq_type+0x78/0xd0\n\nSwitching the mirrored lock to raw_spinlock_t made both splats go away.\n\nConvert the register lock to raw_spinlock_t.  The same lock also\nserializes the GPIO direction/value callbacks and the suspend/resume\nregister save/restore, but all of those critical sections only perform\nMMIO register accesses (ioread32()/iowrite32()) and\nirq_set_handler_locked(); none of them contain sleepable operations.\nKeeping this register lock non-sleeping is therefore appropriate for the\nirqchip callbacks and does not change the GPIO-side locking contract.\n\nThis is the same class of issue and fix as recently addressed for other\nGPIO controllers, e.g. commit 286533cb14a3 (\"gpio: sch: use raw_spinlock_t\nin the irq startup path\") and commit 90f0109019e6 (\"gpio: eic-sprd: use\nraw_spinlock_t in the irq startup path\").","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/16da33cb36e663b6967112185e11d00ce8ff957c","https://git.kernel.org/stable/c/466ab0c41d5f54f71cee60619d07c4abd0ffd2cd","https://git.kernel.org/stable/c/935e6872db7faecfbe1a10b3f5d97a62fdff5ec9","https://git.kernel.org/stable/c/98f292cb6d01487d17988d9fd4e19c13e7adb156","https://git.kernel.org/stable/c/a02b8950d619123da64f69b70fe1dadef217dfe4"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74468","score":0.0022,"percentile":0.12515,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}