CVE-2025-71132High· 7.5▾ Twilight

smc91x: fix broken irq-context in PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: l…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jan 14, 2026

Updated

Oct 19, 2026

CVSS

7.5

Vendor

Linux

Product

Linux

CWE

—

Depth score

41 · Moderate

EPSS

0.28% · p19

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

decided 2026-06-10

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 278 days

Jan 14, 2026Published
Disclosed via CVEORG
Oct 19, 2026Record revised
Last analysed / modified upstream
Oct 19, 2026EPSS first tracked
0.3%

Linux #cve.org

Affected

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 1c4cb705e733250d13243f6a69b8b5a92e39b9f6
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 9d222141b00156509d67d80c771fbefa92c43ace
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < ef277ae121b3249c99994652210a326b52d527b0
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 36561b86cb2501647662cfaf91286dd6973804a6
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < b6018d5c1a8f09d5efe4d6961d7ee45fdf3a7ce3
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 6402078bd9d1ed46e79465e1faaa42e3458f8a33
Linux 5.15

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

smc91x: fix broken irq-context in PREEMPT_RT

When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC:

[ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20

This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero.

To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().

Affected

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 1c4cb705e733250d13243f6a69b8b5a92e39b9f6
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 9d222141b00156509d67d80c771fbefa92c43ace
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < ef277ae121b3249c99994652210a326b52d527b0
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 36561b86cb2501647662cfaf91286dd6973804a6
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < b6018d5c1a8f09d5efe4d6961d7ee45fdf3a7ce3
Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 6402078bd9d1ed46e79465e1faaa42e3458f8a33
Linux 5.15

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

smc91x: fix broken irq-context in PREEMPT_RT

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

smc91x: fix broken irq-context in PREEMPT_RT

When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC:

To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().

Affected

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 1c4cb705e733250d13243f6a69b8b5a92e39b9f6

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 9d222141b00156509d67d80c771fbefa92c43ace

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < ef277ae121b3249c99994652210a326b52d527b0

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 36561b86cb2501647662cfaf91286dd6973804a6

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < b6018d5c1a8f09d5efe4d6961d7ee45fdf3a7ce3

Linux >= 342a93247e0837101f27bbcca26f402902df98dc < 6402078bd9d1ed46e79465e1faaa42e3458f8a33

Linux 5.15