---
id: CVE-2025-38632
title: 'pinmux: fix race causing mux_owner NULL with active mux_usecount'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pinmux: fix race causing mux_owner NULL with active mux_usecount

  commit 5a3e85c3c397 ("pinmux: Use sequential access to access
  desc->pinmux data") tried to address the…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d25e45dcf8e32062f7935e4ba154869043812ab6 <
    8434dec94e73cad527341d6280895191d949a702
  - >-
    Linux >= 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b <
    9b2a3e7189028aa7c4d53a84364f2ea9fb209787
  - >-
    Linux >= c11e2ec9a780f54982a187ee10ffd1b810715c85 <
    9ea3f6b9a67be3476e331ce51cac316c2614a564
  - >-
    Linux >= 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e <
    b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804
  - >-
    Linux >= 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e <
    22b585cbd67d14df3b91529d1b990661c300faa9
  - >-
    Linux >= 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e <
    0b075c011032f88d1cfde3b45d6dcf08b44140eb
  - Linux >= 6.6.66 < 6.6.102
  - Linux >= 6.12.5 < 6.12.42
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:05:29.790577Z'
published: '2025-08-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:49.802Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38632'
references:
  - url: 'https://git.kernel.org/stable/c/8434dec94e73cad527341d6280895191d949a702'
  - url: 'https://git.kernel.org/stable/c/9b2a3e7189028aa7c4d53a84364f2ea9fb209787'
  - url: 'https://git.kernel.org/stable/c/9ea3f6b9a67be3476e331ce51cac316c2614a564'
  - url: 'https://git.kernel.org/stable/c/b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804'
  - url: 'https://git.kernel.org/stable/c/22b585cbd67d14df3b91529d1b990661c300faa9'
  - url: 'https://git.kernel.org/stable/c/0b075c011032f88d1cfde3b45d6dcf08b44140eb'
tags:
  - cve.org
epss: 0.00142
epssPercentile: 0.03549
ingestedAt: '2026-11-03T19:53:18.505Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

pinmux: fix race causing mux_owner NULL with active mux_usecount

commit 5a3e85c3c397 ("pinmux: Use sequential access to access
desc->pinmux data") tried to address the issue when two client of the
same gpio calls pinctrl_select_state() for the same functionality, was
resulting in NULL pointer issue while accessing desc->mux_owner.
However, issue was not completely fixed due to the way it was handled
and it can still result in the same NULL pointer.

The issue occurs due to the following interleaving:

     cpu0 (process A)                   cpu1 (process B)

      pin_request() {                   pin_free() {

                                         mutex_lock()
                                         desc->mux_usecount--; //becomes 0
                                         ..
                                         mutex_unlock()

  mutex_lock(desc->mux)
  desc->mux_usecount++; // becomes 1
  desc->mux_owner = owner;
  mutex_unlock(desc->mux)

                                         mutex_lock(desc->mux)
                                         desc->mux_owner = NULL;
                                         mutex_unlock(desc->mux)

This sequence leads to a state where the pin appears to be in use
(`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can
cause NULL pointer on next pin_request on the same pin.

Ensure that updates to mux_usecount and mux_owner are performed
atomically under the same lock. Only clear mux_owner when mux_usecount
reaches zero and no new owner has been assigned.

## Affected

- `Linux >= d25e45dcf8e32062f7935e4ba154869043812ab6 < 8434dec94e73cad527341d6280895191d949a702`
- `Linux >= 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b < 9b2a3e7189028aa7c4d53a84364f2ea9fb209787`
- `Linux >= c11e2ec9a780f54982a187ee10ffd1b810715c85 < 9ea3f6b9a67be3476e331ce51cac316c2614a564`
- `Linux >= 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e < b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804`
- `Linux >= 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e < 22b585cbd67d14df3b91529d1b990661c300faa9`
- `Linux >= 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e < 0b075c011032f88d1cfde3b45d6dcf08b44140eb`
- `Linux >= 6.6.66 < 6.6.102`
- `Linux >= 6.12.5 < 6.12.42`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.