CVE-2026-64428 Overview
CVE-2026-64428 is a Linux kernel locking flaw in the SCH (South Cluster Hub) GPIO driver. The sch_irq_unmask() callback updates controller state through sch_irq_mask_unmask(), which acquires sch->lock using spin_lock_irqsave(). This callback runs in a non-sleepable context via irq_startup() during IRQ setup. On PREEMPT_RT kernels, a regular spinlock_t is converted into a sleeping lock, producing a "sleeping function called from invalid context" bug reported by lockdep. The fix converts the SCH controller lock to raw_spinlock_t, which remains non-sleeping under PREEMPT_RT.
Critical Impact
On PREEMPT_RT-enabled Linux systems using the SCH GPIO controller, requesting an IRQ triggers a lockdep-detected invalid sleeping context in atomic code, causing kernel warnings and potential instability.
Affected Products
- Linux kernel builds including the gpio-sch driver
- Systems running PREEMPT_RT real-time kernel configurations
- Platforms exposing Intel SCH (South Cluster Hub) GPIO controllers
Discovery Timeline
- 2026-07-25 - CVE-2026-64428 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64428
Vulnerability Analysis
The defect resides in the SCH GPIO irqchip startup path. When a driver calls request_threaded_irq(), the kernel walks through __setup_irq() and invokes irq_startup(), which triggers the irqchip irq_unmask callback. In this driver, sch_irq_unmask() calls sch_irq_mask_unmask(), which acquires sch->lock using spin_lock_irqsave().
On a standard kernel, spin_lock_irqsave() is a genuine spinning primitive and is safe from atomic context. On PREEMPT_RT, however, spinlock_t is remapped to a sleeping mutex to enable preemption of critical sections. Acquiring it while hardirqs are disabled during IRQ setup violates the atomic-context contract, and lockdep flags the condition as a sleeping-function-in-invalid-context bug.
The issue was surfaced by a static analysis tool and reproduced with a proof-of-concept using the request_threaded_irq() → __setup_irq() → irq_startup() → sch_irq_unmask() chain.
Root Cause
The SCH controller lock was declared as spinlock_t, which behaves as a sleeping lock on PREEMPT_RT. Because the same lock is taken from an atomic irqchip callback, the type is incompatible with the calling context. The corrected implementation uses raw_spinlock_t, which retains true spinning semantics on all kernel configurations.
Attack Vector
The condition is a locking correctness bug, not a remote or unauthenticated attack surface. It is triggered by legitimate kernel activity, specifically registering an IRQ for a GPIO line handled by the SCH driver on a PREEMPT_RT kernel. Observable effects include kernel splats, potential scheduling anomalies inside atomic sections, and downstream reliability issues on real-time workloads.
See the upstream patches for the exact source-level changes, including Linux Kernel Commit 286533c and Linux Kernel Commit 4f03a15c.
Detection Methods for CVE-2026-64428
Indicators of Compromise
- Kernel log entries containing BUG: sleeping function called from invalid context referencing sch_irq_mask_unmask or sch_rt_spin_lock_irqsave.
- Lockdep backtraces showing the call chain __setup_irq → irq_startup → sch_irq_unmask → sch_irq_mask_unmask.
- Warnings observed on PREEMPT_RT kernels immediately after IRQ registration for SCH GPIO lines.
Detection Strategies
- Audit kernel builds for CONFIG_PREEMPT_RT=y combined with CONFIG_GPIO_SCH=y or =m.
- Parse dmesg and journald output for lockdep and "invalid context" messages tied to the gpio-sch module.
- Compare running kernel versions against the fixed commits published on git.kernel.org for the gpio-sch driver.
Monitoring Recommendations
- Forward kernel logs from Linux fleet endpoints to a central analytics platform and alert on sleeping function called from invalid context patterns.
- Track kernel package versions across real-time and embedded Linux systems to confirm patch coverage.
- Include lockdep output in crash-dump and boot-log collection for PREEMPT_RT deployments.
How to Mitigate CVE-2026-64428
Immediate Actions Required
- Upgrade to a Linux kernel release that includes the gpio: sch: use raw_spinlock_t in the irq startup path fix.
- On distributions shipping backports, apply the vendor kernel update that references the commits listed on git.kernel.org/stable.
- For real-time deployments, defer enabling PREEMPT_RT on hosts using the SCH GPIO driver until patched kernels are installed.
Patch Information
The upstream fix converts sch->lock from spinlock_t to raw_spinlock_t so that the irqchip callback remains non-sleeping under PREEMPT_RT. GPIO direction and value callbacks that share the lock only touch MMIO registers and remain safe with a raw spinlock. The stable-tree fix is available in multiple branches, including Linux Kernel Commit 3b1aa05e, Linux Kernel Commit 41cad91a, Linux Kernel Commit 4508366, Linux Kernel Commit 7a550256, and Linux Kernel Commit a235cec7.
Workarounds
- Disable the gpio-sch module (modprobe -r gpio_sch) on affected PREEMPT_RT systems where SCH GPIO is not required.
- Run a non-PREEMPT_RT kernel configuration on hardware that depends on the SCH GPIO driver until the patch is deployed.
- Restrict drivers and applications that register IRQs against SCH GPIO lines until the kernel is upgraded.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
