In the Linux kernel, the following vulnerability has been resolved:
i2c: qup: jump out of the loop in case of timeout
Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender.
Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT.
[ { "signature_type": "Function", "id": "CVE-2025-38671-0be0b1b0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d05ec13aa3eb868a60dc961b489053a643863ddc", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-292ae38d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7982a14b3012527a9583d12525cd0dc9f8d8934", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38671-2f5c9492", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d33913fce67a93c1eb83396c3c9d6b411dcab33", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38671-32cb0050", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c523bfba46c4b4d7676fb050909533a766698ecd", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38671-3f39fb5b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42c4471b30fa203249f476dd42321cd7efb7f6a8", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-407edca0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89459f168b78e5c801dc8b7ad037b62898bc4f57", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-46c50a30", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d33913fce67a93c1eb83396c3c9d6b411dcab33", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-633507e3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acfa2948be630ad857535cb36153697f3cbf9ca9", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38671-83162a27", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89459f168b78e5c801dc8b7ad037b62898bc4f57", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38671-a36b094c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acfa2948be630ad857535cb36153697f3cbf9ca9", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-a520ea4a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbec4406998185e0311ae97dfacc649f9cd79b0b", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38671-aaa43546", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7982a14b3012527a9583d12525cd0dc9f8d8934", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-b0b8cbd9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42c4471b30fa203249f476dd42321cd7efb7f6a8", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-b131d1d2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c523bfba46c4b4d7676fb050909533a766698ecd", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38671-c0b5b9f8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d05ec13aa3eb868a60dc961b489053a643863ddc", "signature_version": "v1", "target": { "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "307402863207586799179783295902467028146", "305025620942227429031848943892030744881", "24941267261089652958419467329104447945", "247494063776587164964604299466910506021", "121719061851365236256816407511852694224" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38671-edfed9f4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbec4406998185e0311ae97dfacc649f9cd79b0b", "signature_version": "v1", "target": { "function": "qup_i2c_bus_active", "file": "drivers/i2c/busses/i2c-qup.c" }, "digest": { "function_hash": "289079256370089843272772844847059083634", "length": 351.0 }, "deprecated": false } ]