CVE-2025-40142

Root

Cause In the Linux kernel's ALSA PCM subsystem, the function snd_pcm_group_lock_irq() uses spin_lock_irq() to acquire a spinlock and disable interrupts. On PREEMPT_RT, spin_lock_irq() does not disable softirqs, which remain preemptible. This allows a timer softirq (e.g., TIMER_SOFTIRQ) to run concurrently on the same CPU, potentially leading to a deadlock due to the per-CPU lock softirq_ctrl.lock being acquired in both hrtimer_cancel() and hrtimer_run_softirq() [1].

Exploitation

The attack surface requires the ability to trigger a timer callback while the PCM group lock is held. On PREEMPT_RT, this can occur naturally via hrtimer operations. No specific prerequisites beyond having a system running a PREEMPT_RT kernel are needed; the deadlock can be triggered by normal timer usage.

Impact

If the deadlock occurs, it results in a kernel lockup or denial of service. The vulnerability does not allow arbitrary code execution or privilege escalation, as it is a locking issue.

Mitigation

The vulnerability is fixed by manually disabling softirqs with local_bh_disable() before acquiring the lock on PREEMPT_RT [2]. The fix was committed to the Linux kernel stable tree. Users are advised to update to a patched kernel version.