LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71180: counter: interrupt-cnt: Drop IRQF_NO_THREAD flag

In the Linux kernel, the following vulnerability has been resolved: counter: interrupt-cnt: Drop IRQF_NO_THREAD flag An IRQ handler can either be IRQF_NO_THREAD or acquire spinlock_t, as CONFIG_PROVE_RAW_LOCK_NESTING warns: ============================= [ BUG: Invalid wait context ] 6.18.0-rc1+git... #1 ----------------------------- some-user-space-process/1251 is trying to lock: (&counter->events_list_lock){....}-{3:3}, at: counter_push_event [counter] other info that might help us debug this: context-{2:2} no locks held by some-user-space-process/.... stack backtrace: CPU: 0 UID: 0 PID: 1251 Comm: some-user-space-process 6.18.0-rc1+git... #1 PREEMPT Call trace: show_stack (C) dump_stack_lvl dump_stack __lock_acquire lock_acquire _raw_spin_lock_irqsave counter_push_event [counter] interrupt_cnt_isr [interrupt_cnt] __handle_irq_event_percpu handle_irq_event handle_simple_irq handle_irq_desc generic_handle_domain_irq gpio_irq_handler handle_irq_desc generic_handle_domain_irq gic_handle_irq call_on_irq_stack do_interrupt_handler el0_interrupt __el0_irq_handler_common el0t_64_irq_handler el0t_64_irq ... and Sebastian correctly points out. Remove IRQF_NO_THREAD as an alternative to switching to raw_spinlock_t, because the latter would limit all potential nested locks to raw_spinlock_t only.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability issue in the interrupt counter driver. The documented problem is an invalid locking context when an interrupt handler runs with IRQF_NO_THREAD while using a normal spinlock. Public sources do not provide CVSS, CWE, or business-impact detail.

Executive priority

Treat as a kernel maintenance item unless affected hardware or warning logs are present. There is insufficient public evidence for emergency response, but kernel fixes should flow through normal patch cycles.

Technical view

The fix removes IRQF_NO_THREAD from the counter interrupt-cnt driver. The CVE text shows CONFIG_PROVE_RAW_LOCK_NESTING reporting an invalid wait context through counter_push_event and interrupt_cnt_isr. The source frames the change as avoiding raw_spinlock_t constraints across nested locks.

Likely exposure

Exposure appears limited to Linux systems using or shipping the affected counter interrupt-cnt kernel driver. The source lists Linux kernel versions and stable commits, but not distro package names, configurations, or hardware-specific reachability.

Exploitation context

No active exploitation is reported in the provided sources, and the CVE is not marked KEV. The bundle does not describe a remote attack path, privilege requirement, proof of concept, or weaponized exploit.

Researcher notes

Evidence is narrow: kernel commit text, affected version markers, and stable references. The root issue is lock-context correctness in an IRQ handler, not a described exploit primitive. Distro-level affectedness requires separate vendor confirmation.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Ask your Linux distributor whether the fix is backported to your kernel package.
  • Prioritize systems using counter, GPIO, or embedded interrupt-counter hardware.
  • Monitor vendor advisories for severity, CVSS, and affected package mapping.

Validation and detection

  • Inventory Linux kernel versions across affected fleets.
  • Check whether the interrupt-cnt driver is built, loaded, or required.
  • Confirm the relevant stable fix appears in vendor changelogs.
  • Review kernel logs for invalid wait context or lock nesting warnings.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71180 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa55ebd47f21f6f0472766fb52c973849e31d1466, a55ebd47f21f6f0472766fb52c973849e31d1466, a55ebd47f21f6f0472766fb52c973849e31d1466, a55ebd47f21f6f0472766fb52c973849e31d1466, a55ebd47f21f6f0472766fb52c973849e31d1466, a55ebd47f21f6f0472766fb52c973849e31d1466unaffected
LinuxLinux5.13, 0, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.