LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21902: acpi: typec: ucsi: Introduce a ->poll_cci method

In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need to do this and on some ACPI implementations it actually breaks in various interesting ways. The only reason to force a sync from the embedded controller is to poll CCI while notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current command is suboptimal, i.e. leading to the following spurious assertion splat: WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi] RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] Call Trace: <TASK> ucsi_init_work+0x3c/0xac0 [typec_ucsi] process_one_work+0x179/0x330 worker_thread+0x252/0x390 kthread+0xd2/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Thus introduce a ->poll_cci() method that works like ->read_cci() with an additional forced sync and document that this should be used when polling with notifications disabled. For all other backends that presumably don't have this issue use the same implementation for both methods.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel issue in USB Type-C UCSI handling on ACPI systems. The source describes unreliable synchronization with firmware/embedded-controller registers that can trigger kernel warning output during initialization. The supplied sources do not show remote compromise, data theft, privilege escalation, or confirmed active exploitation.

Executive priority

Treat as a normal kernel maintenance item unless your fleet depends heavily on USB-C/ACPI UCSI stability. There is no source-backed evidence of active exploitation or severe security impact, but kernel updates should still be scheduled through standard patch management.

Technical view

The ACPI UCSI backend treats UCSI registers as an ACPI opregion copy. Forcing synchronization from the embedded controller can break on some ACPI implementations. The fix introduces a poll_cci method so forced sync is used only when polling CCI with notifications disabled; other backends reuse read_cci behavior.

Likely exposure

Exposure appears limited to Linux systems using affected kernel builds with ACPI UCSI USB Type-C support, such as laptops or systems relying on USB-C controllers and firmware notifications. The affected-version data in the bundle is incomplete and should be reconciled with distro advisories.

Exploitation context

No cited source in the bundle reports active exploitation, KEV listing, public exploit use, or a weaponized path. The evidence points to a kernel correctness and firmware-interaction issue causing warnings or initialization problems rather than a clearly documented attacker-driven impact.

Researcher notes

The source record is sparse: no CVSS, CWE, exploit status, or explicit security impact is provided. Analysis should stay anchored to the kernel change: ACPI opregion synchronization behavior, CCI polling while notifications are disabled, and the referenced stable commits.

Mitigation direction

  • Check Linux distribution or vendor advisories for CVE-2025-21902 fixed kernel packages.
  • Update affected systems to a kernel containing the referenced stable fixes.
  • Prioritize laptops and endpoints with ACPI UCSI USB Type-C controller support.
  • If no update is available, follow vendor guidance; no workaround is named in the sources.

Validation and detection

  • Inventory running Linux kernel versions across endpoint and laptop fleets.
  • Identify systems using ACPI UCSI or typec_ucsi kernel components.
  • Review kernel logs for UCSI reset warnings or initialization failures.
  • Map deployed kernels against vendor advisories and the referenced stable commits.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21902 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc0ca6fd5f6ebde8fc0df8bb5c32629d1284f60d0, fa48d7e81624efdf398b990a9049e9cd75a5aead, fa48d7e81624efdf398b990a9049e9cd75a5aead, 6.12.5unaffected
LinuxLinux6.13, 0, 6.12.19, 6.13.7, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.