CVE-2025-38671 in Linux
Summary
by MITRE • 08/22/2025
In the Linux kernel, the following vulnerability has been resolved:
i2c: qup: jump out of the loop in case of timeout
Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender.
Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/14/2026
The vulnerability identified as CVE-2025-38671 represents a critical timing issue within the Linux kernel's I2C subsystem, specifically affecting the Qualcomm I2C QUP (Quick Transfer Protocol) driver implementation. This flaw manifests in a loop control mechanism that fails to properly terminate execution when timeout conditions occur, creating a potential denial of service scenario. The vulnerability is particularly concerning because it allows malicious or faulty I2C client devices to indefinitely hang kernel execution, effectively preventing other system operations from proceeding normally.
The technical root cause resides in the improper handling of timeout scenarios within the I2C QUP driver's communication loop. When an I2C bus remains active due to a client device, the original code logic only assigns a return value indicating timeout but fails to break out of the processing loop. This design flaw creates a situation where the kernel thread becomes trapped in an infinite loop, continuously attempting to process I2C transactions without proper termination. The vulnerability was particularly evident during extended testing with PCA953x GPIO extenders, which demonstrated how a single faulty client device could cause complete system hang conditions. This behavior directly violates standard kernel safety principles and represents a classic case of inadequate error handling in concurrent system operations.
The operational impact of this vulnerability extends beyond simple system hangs, as it can lead to complete system unresponsiveness and potential data loss in embedded systems that rely heavily on I2C communication protocols. Attackers could exploit this weakness by connecting malicious I2C devices that maintain bus activity while failing to respond properly to timeout conditions, thereby causing sustained denial of service attacks against critical infrastructure. The vulnerability affects systems using Qualcomm-based I2C controllers and demonstrates the importance of proper loop termination and error handling in kernel space drivers. This issue aligns with CWE-128 (Wrap-around Error) and CWE-704 (Incorrect Type Conversion or Cast) categories, as it involves improper handling of timeout conditions and loop control flow. From an ATT&CK framework perspective, this vulnerability maps to T1499.004 (Endpoint Denial of Service) and T1566.001 (Phishing with Social Engineering) as it can be leveraged to create persistent system availability issues.
The fix implemented addresses this vulnerability by modifying the driver logic to ensure proper loop termination when timeout conditions occur. The solution requires that when a timeout is detected, the code not only sets the appropriate return value but also explicitly breaks out of the processing loop and returns control to the caller with the -ETIMEDOUT error code. This change ensures that I2C transactions are properly terminated and system resources are released, preventing the indefinite hanging behavior. The mitigation approach follows established kernel development practices for error handling and demonstrates the importance of proper resource management in kernel drivers. System administrators should prioritize applying this patch to all affected Linux kernel versions, particularly in embedded systems and IoT devices that utilize Qualcomm I2C controllers, as these environments are most susceptible to prolonged denial of service conditions caused by faulty hardware interactions.