In the Linux kernel, the following vulnerability has been resolved:
i2c: qup: jump out of the loop in case of timeout
Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender.
Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT.
[
{
"id": "CVE-2025-38671-0be0b1b0",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d05ec13aa3eb868a60dc961b489053a643863ddc",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38671-292ae38d",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7982a14b3012527a9583d12525cd0dc9f8d8934",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-2f5c9492",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d33913fce67a93c1eb83396c3c9d6b411dcab33",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38671-32cb0050",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c523bfba46c4b4d7676fb050909533a766698ecd",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38671-3f39fb5b",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42c4471b30fa203249f476dd42321cd7efb7f6a8",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38671-407edca0",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89459f168b78e5c801dc8b7ad037b62898bc4f57",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-46c50a30",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d33913fce67a93c1eb83396c3c9d6b411dcab33",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-633507e3",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acfa2948be630ad857535cb36153697f3cbf9ca9",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-83162a27",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89459f168b78e5c801dc8b7ad037b62898bc4f57",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38671-a36b094c",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acfa2948be630ad857535cb36153697f3cbf9ca9",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38671-a520ea4a",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbec4406998185e0311ae97dfacc649f9cd79b0b",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-aaa43546",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7982a14b3012527a9583d12525cd0dc9f8d8934",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38671-b0b8cbd9",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42c4471b30fa203249f476dd42321cd7efb7f6a8",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-b131d1d2",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c523bfba46c4b4d7676fb050909533a766698ecd",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-c0b5b9f8",
"digest": {
"line_hashes": [
"307402863207586799179783295902467028146",
"305025620942227429031848943892030744881",
"24941267261089652958419467329104447945",
"247494063776587164964604299466910506021",
"121719061851365236256816407511852694224"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d05ec13aa3eb868a60dc961b489053a643863ddc",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38671-edfed9f4",
"digest": {
"length": 351.0,
"function_hash": "289079256370089843272772844847059083634"
},
"deprecated": false,
"target": {
"file": "drivers/i2c/busses/i2c-qup.c",
"function": "qup_i2c_bus_active"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbec4406998185e0311ae97dfacc649f9cd79b0b",
"signature_version": "v1",
"signature_type": "Function"
}
]