{
  "cveId": "CVE-2026-80562",
  "url": "https://patchblox.com/security/cve/CVE-2026-80562",
  "summary": "CVE-2026-80562 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-80562, released August 30, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "gpio: ml-ioh: use raw_spinlock_t for the register lock",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  gpio: ml-ioh: use raw_spinlock_t for the register lock  ioh_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip-\u003Espinlock with spin_lock_irqsave().  This callback is reached from __setup_irq() -\u003E __irq_set_trigger() -\u003E chip-\u003Eirq_set_type() while the caller holds desc-\u003Elock, a raw_spinlock_t, with hardirqs disabled. That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is an rtmutex-backed sleeping lock, so acquiring it there is invalid. ioh_irq_enable() and ioh_irq_disable() take the same lock from the .irq_enable/.irq_disable callbacks, which are likewise invoked with desc-\u003Elock held.  Convert the register lock to raw_spinlock_t.  The same lock also serializes the GPIO direction/value callbacks and the suspend/resume register save/restore, and those critical sections only perform short sequences of MMIO register accesses (ioread32()/iowrite32()); the .irq_set_type callback additionally emits a dev_warn() on an unsupported type.  None of these are sleepable operations, so keeping this register lock non-sleeping is appropriate for the irqchip callbacks and does not change the GPIO-side locking contract.  This is the same fix as commit a02b8950d619 (\u0022gpio: pch: use raw_spinlock_t for the register lock\u0022); this driver shares the same structure as gpio-pch.",
  "published": "2026-08-26T15:17:11Z",
  "severity": "Moderate",
  "cvss": 7.1,
  "epss": 0.00181,
  "epssPercentile": 0.0772,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80562",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.187-1",
      "fix": "DEBIAN-CVE-2026-80562",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80562",
      "released": "2026-08-30T00:56:53Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.107-1",
      "fix": "DEBIAN-CVE-2026-80562",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80562",
      "released": "2026-08-30T00:56:53Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.10-1",
      "fix": "DEBIAN-CVE-2026-80562",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80562",
      "released": "2026-08-30T00:56:53Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.107-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-80562",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80562",
      "released": "2026-08-30T00:56:53Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}