CVE-2026-64429 Overview
CVE-2026-64429 is a Linux kernel locking flaw in the Spreadtrum EIC (External Interrupt Controller) GPIO driver (gpio-eic-sprd). The sprd_eic_irq_unmask() callback updates controller state via sprd_eic_update(), which acquires sprd_eic->lock using spin_lock_irqsave(). This callback is reachable from irq_startup() during IRQ setup, a non-sleepable context. On kernels built with PREEMPT_RT, a regular spinlock_t becomes a sleeping lock, producing a "sleeping function called from invalid context" bug and potential system instability.
Critical Impact
On PREEMPT_RT Linux kernels, requesting a Spreadtrum EIC GPIO IRQ can invoke a sleeping lock from atomic context, triggering lockdep violations and risking scheduling failures on affected hardware.
Affected Products
- Linux kernel builds that include the gpio-eic-sprd driver for Spreadtrum/Unisoc SoCs
- Kernels compiled with CONFIG_PREEMPT_RT on affected Spreadtrum platforms
- Stable kernel branches prior to the fixes referenced in the upstream commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64429 published to the National Vulnerability Database
- 2026-07-25 - Last updated in the NVD database
Technical Details for CVE-2026-64429
Vulnerability Analysis
The defect lives in drivers/gpio/gpio-eic-sprd.c. The sprd_eic_irq_unmask() handler enables a GPIO IRQ and then calls sprd_eic_update() to commit register changes to the controller. sprd_eic_update() serializes access to memory-mapped I/O registers using spin_lock_irqsave(&sprd_eic->lock, ...).
During interrupt registration, the kernel path request_threaded_irq() → __setup_irq() → irq_startup() invokes the unmask callback with hardirqs disabled. On a stock kernel, spinlock_t maps to a raw spinning primitive, so the sequence is safe. On PREEMPT_RT, spinlock_t is converted to an rt-mutex that may sleep, which is disallowed in this atomic context. Lockdep reports the invalid call chain with sprd_rt_spin_lock_irqsave inside sprd_eic_update, sprd_eic_irq_unmask, and __setup_irq.
The upstream fix converts sprd_eic->lock to raw_spinlock_t, which retains true spinning semantics under PREEMPT_RT. The critical section only performs MMIO register updates and contains no sleepable operations, so a raw spinlock is the correct primitive for the irqchip callback path.
Root Cause
The root cause is a mismatch between the lock type (spinlock_t) and the atomic context imposed by irqchip callbacks under PREEMPT_RT. The driver assumed non-RT semantics where spinlock_t never sleeps, an assumption that fails on real-time kernels.
Attack Vector
This is a local kernel stability defect, not a remote attack. Triggering the condition requires the affected Spreadtrum EIC hardware, a PREEMPT_RT kernel, and code paths that request an EIC-backed GPIO interrupt. Impact is limited to kernel warnings, scheduling anomalies, or potential denial of service on the affected platform. See the upstream commit references for the exact patched source. Refer to the Linux Kernel Commit for the definitive fix.
Detection Methods for CVE-2026-64429
Indicators of Compromise
- Kernel log entries matching BUG: sleeping function called from invalid context with sprd_eic_update or sprd_eic_irq_unmask in the backtrace.
- Lockdep warnings referencing __setup_irq and sprd_rt_spin_lock_irqsave on Spreadtrum/Unisoc platforms.
- Repeated GPIO IRQ registration failures or scheduling anomalies on PREEMPT_RT builds.
Detection Strategies
- Enable CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_PROVE_LOCKING in test kernels to surface invalid sleeping-lock acquisitions.
- Audit running kernels for the gpio-eic-sprd module and confirm whether PREEMPT_RT is enabled via uname -a and /proc/config.gz.
- Correlate dmesg output across fleet devices to identify recurring EIC-related lockdep splats.
Monitoring Recommendations
- Forward kernel logs from Spreadtrum-based devices to a central log platform and alert on lockdep and sleeping-context messages.
- Track the installed kernel version against the fixed stable branches referenced in the upstream commits.
- Monitor device uptime and unexpected reboots on real-time Spreadtrum deployments to catch stability regressions early.
How to Mitigate CVE-2026-64429
Immediate Actions Required
- Update affected systems to a Linux stable kernel that includes the raw_spinlock_t conversion for sprd_eic->lock.
- Inventory devices using Spreadtrum/Unisoc SoCs with the gpio-eic-sprd driver and prioritize PREEMPT_RT builds.
- Rebuild and redeploy custom kernels after applying the upstream patch to any vendor kernel fork.
Patch Information
The fix converts the EIC controller lock to raw_spinlock_t so the critical section never sleeps, which is appropriate for irqchip callbacks that run with hardirqs disabled. Multiple stable branches received backports. Reference the upstream fixes at commit 19d63fd5, commit 4750909a, commit 581ac2ad, commit 5c3c9ec1, commit 6112fba4, commit 90f01090, commit 96612bf2, and commit e244cd8b.
Workarounds
- Run a non-PREEMPT_RT kernel on affected Spreadtrum devices until the patch is deployed, if operational requirements permit.
- Avoid registering new IRQ consumers on EIC-backed GPIOs during runtime on real-time kernels.
- Unload or blacklist the gpio-eic-sprd module on systems that do not require EIC GPIO interrupts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
