iio: light: opt3001: fix deadlock due to concurrent flag access (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.16 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.
Weaknesses (CWE)
- CWE-667 — Improper Locking
References
- https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9
- https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc
- https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5
- https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f
- https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719
- https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7
- https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77
- https://git.kernel.org/stable/c/f063a28002e3350088b4577c5640882bf4ea17ea
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-15859
- GCVE · GCVE-0-2025-37968
CERT-FR advisories
- CERTFR-2026-AVI-0565 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0246 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0227 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0218 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0194 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0169 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1135 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1075 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0894 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0825 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0723 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0721 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0649 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0607 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0587 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0529 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.3 < 5.4.299cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.243cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.192cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.151cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.105cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.30cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.14.7cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 94a9b7b1809f56cfaa080e70ec49b6979563a237 < a9c56ccb7cddfca754291fb24b108a5350a5fbe9 ; affected 94a9b7b1809f56cfaa080e70ec49b6979563a237 < 957e8be112636d9bc692917286e81e54bd87decc ; affected 94a9b7b1809f56cfaa080e70ec49b6979563a237 < 1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 ; affected 94a9b7b1809f56cfaa080e70ec49b6979563a237 < 748ebd8e61d0bc182c331b8df3887af7285c8a8f ; affected 94a9b7b1809f56cfaa080e70ec49b6979563a237 < e791bf216c9e236b34dabf514ec0ede140cca719 ; affected 94a9b7b1809f56cfaa080e70ec49b6979563a237 < 7ca84f6a22d50bf8b31efe9eb05f9859947266d7 |
| Linux · Linux | affected 4.3 ; unaffected 0 < 4.3 ; unaffected 5.4.299 ≤ 5.4.* ; unaffected 5.10.243 ≤ 5.10.* ; unaffected 5.15.192 ≤ 5.15.* ; unaffected 6.1.151 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |