CVE-2025-21902: acpi: typec: ucsi: Introduce a ->poll_cci method
In the Linux kernel, the following vulnerability has been resolved:
acpi: typec: ucsi: Introduce a ->poll_cci method
For the ACPI backend of UCSI the UCSI "registers" are just a memory copy
of the register values in an opregion. The ACPI implementation in the
BIOS ensures that the opregion contents are synced to the embedded
controller and it ensures that the registers (in particular CCI) are
synced back to the opregion on notifications. While there is an ACPI call
that syncs the actual registers to the opregion there is rarely a need to
do this and on some ACPI implementations it actually breaks in various
interesting ways.
The only reason to force a sync from the embedded controller is to poll
CCI while notifications are disabled. Only the ucsi core knows if this
is the case and guessing based on the current command is suboptimal, i.e.
leading to the following spurious assertion splat:
WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi]
CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1
Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023
Workqueue: events_long ucsi_init_work [typec_ucsi]
RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi]
Call Trace:
<TASK>
ucsi_init_work+0x3c/0xac0 [typec_ucsi]
process_one_work+0x179/0x330
worker_thread+0x252/0x390
kthread+0xd2/0x100
ret_from_fork+0x34/0x50
ret_from_fork_asm+0x1a/0x30
</TASK>
Thus introduce a ->poll_cci() method that works like ->read_cci() with an
additional forced sync and document that this should be used when polling
with notifications disabled. For all other backends that presumably don't
have this issue use the same implementation for both methods.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel issue in USB Type-C UCSI handling on ACPI systems. The source describes unreliable synchronization with firmware/embedded-controller registers that can trigger kernel warning output during initialization. The supplied sources do not show remote compromise, data theft, privilege escalation, or confirmed active exploitation.
Executive priority
Treat as a normal kernel maintenance item unless your fleet depends heavily on USB-C/ACPI UCSI stability. There is no source-backed evidence of active exploitation or severe security impact, but kernel updates should still be scheduled through standard patch management.
Technical view
The ACPI UCSI backend treats UCSI registers as an ACPI opregion copy. Forcing synchronization from the embedded controller can break on some ACPI implementations. The fix introduces a poll_cci method so forced sync is used only when polling CCI with notifications disabled; other backends reuse read_cci behavior.
Likely exposure
Exposure appears limited to Linux systems using affected kernel builds with ACPI UCSI USB Type-C support, such as laptops or systems relying on USB-C controllers and firmware notifications. The affected-version data in the bundle is incomplete and should be reconciled with distro advisories.
Exploitation context
No cited source in the bundle reports active exploitation, KEV listing, public exploit use, or a weaponized path. The evidence points to a kernel correctness and firmware-interaction issue causing warnings or initialization problems rather than a clearly documented attacker-driven impact.
Researcher notes
The source record is sparse: no CVSS, CWE, exploit status, or explicit security impact is provided. Analysis should stay anchored to the kernel change: ACPI opregion synchronization behavior, CCI polling while notifications are disabled, and the referenced stable commits.
Mitigation direction
Check Linux distribution or vendor advisories for CVE-2025-21902 fixed kernel packages.
Update affected systems to a kernel containing the referenced stable fixes.
Prioritize laptops and endpoints with ACPI UCSI USB Type-C controller support.
If no update is available, follow vendor guidance; no workaround is named in the sources.
Validation and detection
Inventory running Linux kernel versions across endpoint and laptop fleets.
Identify systems using ACPI UCSI or typec_ucsi kernel components.
Review kernel logs for UCSI reset warnings or initialization failures.
Map deployed kernels against vendor advisories and the referenced stable commits.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-21902 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
4Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Apr 1, 2025, 15:40 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.