{"id":"DEBIAN-CVE-2025-38040","details":"In the Linux kernel, the following vulnerability has been resolved:  serial: mctrl_gpio: split disable_ms into sync and no_sync APIs  The following splat has been observed on a SAMA5D27 platform using atmel_serial:  BUG: sleeping function called from invalid context at kernel/irq/manage.c:738 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 27, name: kworker/u5:0 preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last  enabled at (0): [\u003c00000000\u003e] 0x0 hardirqs last disabled at (0): [\u003cc01588f0\u003e] copy_process+0x1c4c/0x7bec softirqs last  enabled at (0): [\u003cc0158944\u003e] copy_process+0x1ca0/0x7bec softirqs last disabled at (0): [\u003c00000000\u003e] 0x0 CPU: 0 UID: 0 PID: 27 Comm: kworker/u5:0 Not tainted 6.13.0-rc7+ #74 Hardware name: Atmel SAMA5 Workqueue: hci0 hci_power_on [bluetooth] Call trace:   unwind_backtrace from show_stack+0x18/0x1c   show_stack from dump_stack_lvl+0x44/0x70   dump_stack_lvl from __might_resched+0x38c/0x598   __might_resched from disable_irq+0x1c/0x48   disable_irq from mctrl_gpio_disable_ms+0x74/0xc0   mctrl_gpio_disable_ms from atmel_disable_ms.part.0+0x80/0x1f4   atmel_disable_ms.part.0 from atmel_set_termios+0x764/0x11e8   atmel_set_termios from uart_change_line_settings+0x15c/0x994   uart_change_line_settings from uart_set_termios+0x2b0/0x668   uart_set_termios from tty_set_termios+0x600/0x8ec   tty_set_termios from ttyport_set_flow_control+0x188/0x1e0   ttyport_set_flow_control from wilc_setup+0xd0/0x524 [hci_wilc]   wilc_setup [hci_wilc] from hci_dev_open_sync+0x330/0x203c [bluetooth]   hci_dev_open_sync [bluetooth] from hci_dev_do_open+0x40/0xb0 [bluetooth]   hci_dev_do_open [bluetooth] from hci_power_on+0x12c/0x664 [bluetooth]   hci_power_on [bluetooth] from process_one_work+0x998/0x1a38   process_one_work from worker_thread+0x6e0/0xfb4   worker_thread from kthread+0x3d4/0x484   kthread from ret_from_fork+0x14/0x28  This warning is emitted when trying to toggle, at the highest level, some flow control (with serdev_device_set_flow_control) in a device driver. At the lowest level, the atmel_serial driver is using serial_mctrl_gpio lib to enable/disable the corresponding IRQs accordingly.  The warning emitted by CONFIG_DEBUG_ATOMIC_SLEEP is due to disable_irq (called in mctrl_gpio_disable_ms) being possibly called in some atomic context (some tty drivers perform modem lines configuration in regions protected by port lock).  Split mctrl_gpio_disable_ms into two differents APIs, a non-blocking one and a blocking one. Replace mctrl_gpio_disable_ms calls with the relevant version depending on whether the call is protected by some port lock.","modified":"2026-09-01T16:05:48.050695460Z","published":"2025-06-18T10:15:36.400Z","upstream":["CVE-2025-38040"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38040"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.147-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38040.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.32-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38040.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.32-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38040.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}