CVE-2025-71180

counter: interrupt-cnt: Drop IRQF_NO_THREAD flag

published January 31, 2026

CVSS
—
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

counter: interrupt-cnt: Drop IRQF_NO_THREAD flag

An IRQ handler can either be IRQF_NO_THREAD or acquire spinlock_t, as

CONFIG_PROVE_RAW_LOCK_NESTING warns:

=============================

[ BUG: Invalid wait context ]

6.18.0-rc1+git... #1

-----------------------------

some-user-space-process/1251 is trying to lock:

(&counter->events_list_lock){....}-{3:3}, at: counter_push_event [counter]

other info that might help us debug this:

context-{2:2}

no locks held by some-user-space-process/....

stack backtrace:

CPU: 0 UID: 0 PID: 1251 Comm: some-user-space-process 6.18.0-rc1+git... #1 PREEMPT

Call trace:

show_stack (C)

dump_stack_lvl

dump_stack

__lock_acquire

lock_acquire

_raw_spin_lock_irqsave

counter_push_event [counter]

interrupt_cnt_isr [interrupt_cnt]

__handle_irq_event_percpu

handle_irq_event

handle_simple_irq

handle_irq_desc

generic_handle_domain_irq

gpio_irq_handler

handle_irq_desc

generic_handle_domain_irq

gic_handle_irq

call_on_irq_stack

do_interrupt_handler

el0_interrupt

__el0_irq_handler_common

el0t_64_irq_handler

el0t_64_irq

... and Sebastian correctly points out. Remove IRQF_NO_THREAD as an

alternative to switching to raw_spinlock_t, because the latter would limit

all potential nested locks to raw_spinlock_t only.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.6th percentile
Published
2026-01-31T11:38Z
EPSS history
Timeline
  • 31 JAN 11:38Z
    counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
    cvelistv5