Critical Interrupt Logic Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-38516: In the Linux kernel, the following vulnerability has been resolved: pinctrl: qcom: msm: mark certain pins as invalid for interrupts On some platforms, the UFS-reset pin has no interrupt logic in TLMM but is nevertheless... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the system, including user applications. This vulnerability specifically affects the pinctrl-msm driver, which manages GPIO pins for Qualcomm platforms. The issue arises when certain pins are incorrectly registered as interrupt-capable, leading to potential kernel crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the pinctrl-msm driver related to the handling of GPIO pins. Specifically, the UFS-reset pin on some platforms lacks interrupt logic in the TLMM but is still registered as a GPIO. This misconfiguration allows user-space applications to trigger a BUG() in the driver by requesting pins with an intr_detection_width setting that is not 1 or 2. This can lead to kernel crashes, making the system unstable and potentially exposing it to further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using GPIO pins that are known to trigger the vulnerability. Specifically, refrain from executing commands like 'gpiomon -c 0 113' that may invoke the problematic behavior in the pinctrl-msm driver.
Conclusion
The CVE-2025-38516 vulnerability in the Linux kernel poses a significant risk to systems running affected Debian packages. It is crucial to apply the necessary updates to mitigate the risk of kernel crashes and ensure system stability. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38516 is a vulnerability in the Linux kernel that affects the pinctrl-msm driver, allowing user-space applications to crash the kernel by improperly requesting GPIO pins.
Debian 11 and Debian 14 are affected, while Debian 12 and Debian 13 have patched versions available.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid using the GPIO pins that trigger the vulnerability as a temporary workaround.
More information can be found in the CVE details and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
