Kernel Hang Vulnerability in Linux Package: i2c Client Timeout Issue
Summary
CVE-2025-38671: In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active b... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It is responsible for facilitating communication between software and hardware components. The kernel is modular, allowing for various functionalities to be added or removed as needed. This vulnerability specifically affects the i2c subsystem, which is used for communication with peripheral devices. The issue arises when an i2c client keeps the bus active, potentially causing the kernel to hang.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the i2c subsystem related to the qup driver. The original logic fails to exit a loop when a timeout occurs, allowing a malicious or buggy i2c client to keep the bus active indefinitely. This can lead to a kernel hang, which disrupts system operations and can cause significant downtime. The vulnerability has been observed during prolonged testing with a PCA953x GPIO extender, highlighting its potential impact in real-world scenarios.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if immediate patching is not feasible, consider disabling the affected i2c clients or limiting their usage until the system can be updated. This may help prevent the kernel from hanging due to the timeout issue.
Conclusion
The CVE-2025-38671 vulnerability in the Linux kernel's i2c subsystem poses a significant risk by allowing a malicious or buggy i2c client to hang the kernel. It is crucial to update to the patched versions of the Linux package to mitigate this risk. Users should also consider workarounds if immediate updates are not possible.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38671 is a vulnerability in the Linux kernel's i2c subsystem that can cause the kernel to hang if an i2c client keeps the bus active during a timeout.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check if your application is affected.
If exploited, this vulnerability can lead to system hangs, causing downtime and potentially affecting critical operations.
Yes, patched versions are available for Debian 13 (6.12.41-1) and Debian 14 (6.16.3-1). It is recommended to update to these versions.
As a temporary measure, consider disabling the affected i2c clients or limiting their usage until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
