CVE-2025-38671

i2c: qup: jump out of the loop in case of timeout

State: Published
Severity: Not scored
Published: Aug 22, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: qup: jump out of the loop in case of timeout

Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender.

Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fbfab1ab065879370541caf0e514987368eb41b2 to before cbec4406998185e0311ae97dfacc649f9cd79b0bAffected fbfab1ab065879370541caf0e514987368eb41b2 to before acfa2948be630ad857535cb36153697f3cbf9ca9Affected fbfab1ab065879370541caf0e514987368eb41b2 to before d05ec13aa3eb868a60dc961b489053a643863ddcAffected fbfab1ab065879370541caf0e514987368eb41b2 to before c523bfba46c4b4d7676fb050909533a766698ecdAffected fbfab1ab065879370541caf0e514987368eb41b2 to before 0d33913fce67a93c1eb83396c3c9d6b411dcab33Affected fbfab1ab065879370541caf0e514987368eb41b2 to before 42c4471b30fa203249f476dd42321cd7efb7f6a8Affected fbfab1ab065879370541caf0e514987368eb41b2 to before 89459f168b78e5c801dc8b7ad037b62898bc4f57Affected fbfab1ab065879370541caf0e514987368eb41b2 to before a7982a14b3012527a9583d12525cd0dc9f8d8934Affected
LinuxLinux	4.17Affected before 4.17Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.148 through 6.1.Not affected 6.6.101 through 6.6.Not affected 6.12.41 through 6.12.Not affected 6.15.9 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

fbfab1ab065879370541caf0e514987368eb41b2 to before cbec4406998185e0311ae97dfacc649f9cd79b0bAffected
fbfab1ab065879370541caf0e514987368eb41b2 to before acfa2948be630ad857535cb36153697f3cbf9ca9Affected
fbfab1ab065879370541caf0e514987368eb41b2 to before d05ec13aa3eb868a60dc961b489053a643863ddcAffected
fbfab1ab065879370541caf0e514987368eb41b2 to before c523bfba46c4b4d7676fb050909533a766698ecdAffected
fbfab1ab065879370541caf0e514987368eb41b2 to before 0d33913fce67a93c1eb83396c3c9d6b411dcab33Affected
fbfab1ab065879370541caf0e514987368eb41b2 to before 42c4471b30fa203249f476dd42321cd7efb7f6a8Affected
fbfab1ab065879370541caf0e514987368eb41b2 to before 89459f168b78e5c801dc8b7ad037b62898bc4f57Affected
fbfab1ab065879370541caf0e514987368eb41b2 to before a7982a14b3012527a9583d12525cd0dc9f8d8934Affected

LinuxLinux

4.17Affected
before 4.17Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.148 through 6.1.*Not affected
6.6.101 through 6.6.*Not affected
6.12.41 through 6.12.*Not affected
6.15.9 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.