CVE-2025-37968

iio: light: opt3001: fix deadlock due to concurrent flag access

published May 20, 2025

CVSS
—
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iio: light: opt3001: fix deadlock due to concurrent flag access

The threaded IRQ function in this driver is reading the flag twice: once to

lock a mutex and once to unlock it. Even though the code setting the flag

is designed to prevent it, there are subtle cases where the flag could be

true at the mutex_lock stage and false at the mutex_unlock stage. This

results in the mutex not being unlocked, resulting in a deadlock.

Fix it by making the opt3001_irq() code generally more robust, reading the

flag into a variable and using the variable value at both stages.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Published
2025-05-20T16:47Z
EPSS history
Timeline
  • 20 MAY 16:47Z
    iio: light: opt3001: fix deadlock due to concurrent flag access
    cvelistv5