Executive brief
A vulnerability in the Linux kernel's driver for the TI OPT3001 light sensor can cause a system deadlock. This sensor is commonly used in hardware to measure ambient light levels. An exploit could allow a local user to cause a denial-of-service, potentially freezing the system or specific hardware functions, impacting operational availability.
Technical details
A race condition exists in the threaded IRQ function of the opt3001 light sensor driver (drivers/iio/light/opt3001.c). The function reads the 'ok_to_ignore_lock' flag twice: once to determine if it should acquire a mutex and again to determine if it should release it. If the flag's state changes between these two reads due to concurrent access, the mutex may be locked but never unlocked. This results in a kernel deadlock (CWE-667). The fix involves reading the flag into a local variable once and using that consistent value for both the lock and unlock logic. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.3 to 5.4.299, 5.5 to 5.10.243, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.30, 6.13 to 6.14.7
Timeline
- 2025-03-21: other: Patch submitted by developer
- 2025-05-20: disclosed: CVE published
- 2025-05-22: patched: Patch merged into stable trees
References
- https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5
- https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77
- https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f
- https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7
- https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc
- https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9
- https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719