CVE-2025-38671 (GCVE-0-2025-38671)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:03 – Updated: 2025-11-03 17:40
VLAI?
Title
i2c: qup: jump out of the loop in case of timeout
Summary
In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender. Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < cbec4406998185e0311ae97dfacc649f9cd79b0b (git)
Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < acfa2948be630ad857535cb36153697f3cbf9ca9 (git)
Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < d05ec13aa3eb868a60dc961b489053a643863ddc (git)
Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < c523bfba46c4b4d7676fb050909533a766698ecd (git)
Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < 0d33913fce67a93c1eb83396c3c9d6b411dcab33 (git)
Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < 42c4471b30fa203249f476dd42321cd7efb7f6a8 (git)
Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < 89459f168b78e5c801dc8b7ad037b62898bc4f57 (git)
Affected: fbfab1ab065879370541caf0e514987368eb41b2 , < a7982a14b3012527a9583d12525cd0dc9f8d8934 (git)
Create a notification for this product.
    Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.4.297 , ≤ 5.4.* (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.148 , ≤ 6.1.* (semver)
Unaffected: 6.6.101 , ≤ 6.6.* (semver)
Unaffected: 6.12.41 , ≤ 6.12.* (semver)
Unaffected: 6.15.9 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:57.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-qup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cbec4406998185e0311ae97dfacc649f9cd79b0b",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            },
            {
              "lessThan": "acfa2948be630ad857535cb36153697f3cbf9ca9",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            },
            {
              "lessThan": "d05ec13aa3eb868a60dc961b489053a643863ddc",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            },
            {
              "lessThan": "c523bfba46c4b4d7676fb050909533a766698ecd",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            },
            {
              "lessThan": "0d33913fce67a93c1eb83396c3c9d6b411dcab33",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            },
            {
              "lessThan": "42c4471b30fa203249f476dd42321cd7efb7f6a8",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            },
            {
              "lessThan": "89459f168b78e5c801dc8b7ad037b62898bc4f57",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            },
            {
              "lessThan": "a7982a14b3012527a9583d12525cd0dc9f8d8934",
              "status": "affected",
              "version": "fbfab1ab065879370541caf0e514987368eb41b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-qup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.101",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.41",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.9",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: qup: jump out of the loop in case of timeout\n\nOriginal logic only sets the return value but doesn\u0027t jump out of the\nloop if the bus is kept active by a client. This is not expected. A\nmalicious or buggy i2c client can hang the kernel in this case and\nshould be avoided. This is observed during a long time test with a\nPCA953x GPIO extender.\n\nFix it by changing the logic to not only sets the return value, but also\njumps out of the loop and return to the caller with -ETIMEDOUT."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-28T14:44:37.404Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cbec4406998185e0311ae97dfacc649f9cd79b0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/acfa2948be630ad857535cb36153697f3cbf9ca9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d05ec13aa3eb868a60dc961b489053a643863ddc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c523bfba46c4b4d7676fb050909533a766698ecd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d33913fce67a93c1eb83396c3c9d6b411dcab33"
        },
        {
          "url": "https://git.kernel.org/stable/c/42c4471b30fa203249f476dd42321cd7efb7f6a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/89459f168b78e5c801dc8b7ad037b62898bc4f57"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7982a14b3012527a9583d12525cd0dc9f8d8934"
        }
      ],
      "title": "i2c: qup: jump out of the loop in case of timeout",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38671",
    "datePublished": "2025-08-22T16:03:02.151Z",
    "dateReserved": "2025-04-16T04:51:24.031Z",
    "dateUpdated": "2025-11-03T17:40:57.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.