CVE-2025-38671 i2c: qup: jump out of the loop in case of timeout
A malicious or buggy I2C client can hang the Linux kernel by keeping the bus active, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38671?
CVE-2025-38671 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 22 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i2c: qup: jump out of the loop in case of timeout
Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender.
Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT.
Which versions are affected by CVE-2025-38671?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38671?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38671 being exploited?
There is no known exploitation of CVE-2025-38671 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-66590, AZL-73812, BELL-CVE-2025-38671, DEBIAN-CVE-2025-38671, GHSA-hmc7-frwx-fp3p, ROOT-OS-DEBIAN-11-CVE-2025-38671 and 3 more.