---
id: CVE-2025-23161
title: 'PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type

  The access to the PCI config space via pci_ops::read and pci_ops::write is
  a low-level hardware access. The func…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 <
    c250262d6485ca333e9821f85b07eb383ec546b1
  - >-
    Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 <
    c2968c812339593ac6e2bdd5cc3adabe3f05fa53
  - >-
    Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 <
    13e5148f70e81991acbe0bab5b1b50ba699116e7
  - >-
    Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 <
    5c3cfcf0b4bf43530788b08a8eaf7896ec567484
  - >-
    Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 <
    2358046ead696ca5c7c628d6c0e2c6792619a3e5
  - >-
    Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 <
    20d0a9062c031068fa39f725a32f182b709b5525
  - >-
    Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 <
    18056a48669a040bef491e63b25896561ee14d90
  - Linux 4.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:39:52.254531Z'
published: '2025-05-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:52.614Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-23161'
references:
  - url: 'https://git.kernel.org/stable/c/c250262d6485ca333e9821f85b07eb383ec546b1'
  - url: 'https://git.kernel.org/stable/c/c2968c812339593ac6e2bdd5cc3adabe3f05fa53'
  - url: 'https://git.kernel.org/stable/c/13e5148f70e81991acbe0bab5b1b50ba699116e7'
  - url: 'https://git.kernel.org/stable/c/5c3cfcf0b4bf43530788b08a8eaf7896ec567484'
  - url: 'https://git.kernel.org/stable/c/2358046ead696ca5c7c628d6c0e2c6792619a3e5'
  - url: 'https://git.kernel.org/stable/c/20d0a9062c031068fa39f725a32f182b709b5525'
  - url: 'https://git.kernel.org/stable/c/18056a48669a040bef491e63b25896561ee14d90'
tags:
  - cve.org
epss: 0.00149
epssPercentile: 0.04081
ingestedAt: '2026-11-05T22:38:31.867Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type

The access to the PCI config space via pci_ops::read and pci_ops::write is
a low-level hardware access. The functions can be accessed with disabled
interrupts even on PREEMPT_RT. The pci_lock is a raw_spinlock_t for this
purpose.

A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
acquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in
the same context as the pci_lock.

Make vmd_dev::cfg_lock a raw_spinlock_t type so it can be used with
interrupts disabled.

This was reported as:

  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
  Call Trace:
   rt_spin_lock+0x4e/0x130
   vmd_pci_read+0x8d/0x100 [vmd]
   pci_user_read_config_byte+0x6f/0xe0
   pci_read_config+0xfe/0x290
   sysfs_kf_bin_read+0x68/0x90

[bigeasy: reword commit message]
Tested-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
[kwilczynski: commit log]
[bhelgaas: add back report info from
https://lore.kernel.org/lkml/20241218115951.83062-1-ryotkkr98@gmail.com/]

## Affected

- `Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 < c250262d6485ca333e9821f85b07eb383ec546b1`
- `Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 < c2968c812339593ac6e2bdd5cc3adabe3f05fa53`
- `Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 < 13e5148f70e81991acbe0bab5b1b50ba699116e7`
- `Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 < 5c3cfcf0b4bf43530788b08a8eaf7896ec567484`
- `Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 < 2358046ead696ca5c7c628d6c0e2c6792619a3e5`
- `Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 < 20d0a9062c031068fa39f725a32f182b709b5525`
- `Linux >= 185a383ada2e7794b0e82e040223e741b24d2bf8 < 18056a48669a040bef491e63b25896561ee14d90`
- `Linux 4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.