i2c Client Timeout Bug in Linux Kernel Affects Multiple Device Operations

CVE-2025-38671

What is CVE-2025-38671?

In the Linux kernel, there is a vulnerability in the i2c: qup module that can lead to system instability when a client maintains an active bus connection despite a timeout. This flaw occurs when the original logic incorrectly handles timeouts, merely setting a return value without properly exiting the loop. Consequently, a malicious or faulty i2c client has the potential to hang the kernel, impeding normal operation. A fix has been implemented to ensure that upon a timeout, the logic now correctly exits the loop and returns to the caller with an appropriate -ETIMEDOUT error, thus mitigating the risk of system hang.

References