In the Linux kernel, the following vulnerability has been resolved:
optee: ffa: fix sleep in atomic context
The OP-TEE driver registers the function notif_callback() for FF-A notifications. However, this function is called in an atomic context leading to errors like this when processing asynchronous notifications:
| BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0-00019-g657536ebe0aa #13 | Hardware name: linux,dummy-virt (DT) | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Call trace: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | optee_get_msg_arg+0x7c/0x21c | simple_call_with_arg+0x50/0xc0 | optee_do_bottom_half+0x14/0x20 | notif_callback+0x3c/0x48 | handle_notif_callbacks+0x9c/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | worker_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20
Fix this by adding work queue to process the notification in a non-atomic context.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade dtb-amdUpgrade kernel-symsUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade dtb-alteraUpgrade kernel-sourceUpgrade dtb-allwinnerUpgrade dtb-xilinxUpgrade dtb-qcomUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-develUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade dlm-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-default-optionalUpgrade dtb-apmUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-rtUpgrade kernel-rt-develUpgrade kernel-defaultUpgrade ocfs2-kmp-defaultUpgrade dtb-armUpgrade dtb-rockchipUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-default-vdsoUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-obs-qaUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade kernel-default-livepatchUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade kernel-rt-extraUpgrade kernel-macrosUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-64kbUpgrade dtb-appleUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-rtUpgrade dtb-lgUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-vdsoUpgrade dtb-socionextUpgrade kernel-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade dtb-marvellUpgrade kernel-default-extraUpgrade kselftests-kmp-defaultUpgrade dtb-broadcom | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-lowlatency-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-gkeopUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1014-azureUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-nvidiaUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-gke-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-oem-24.04cUpgrade linux-image-nvidiaUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-ibmUpgrade linux-image-generic-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-1015-awsUpgrade linux-image-raspi-6.14Upgrade linux-image-lowlatency-64kUpgrade linux-image-fips-6.8Upgrade linux-image-realtimeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-intel-iotgUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-fipsUpgrade linux-image-oem-24.04aUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-64k-6.14Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-azure-nvidia-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1015-aws-64kUpgrade linux-image-oem-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-xilinxUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-ibm-classicUpgrade linux-image-awsUpgrade linux-image-gkeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-aws-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-generic-lpaeUpgrade linux-image-gcp-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.14.0-1014-oemUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-genericUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oem-22.04cUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-generic-6.14Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-virtual-6.14Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-34-genericUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-kvmUpgrade linux-image-oracle-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-oracle-64k-lts-24.04 | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub