LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38671: i2c: qup: jump out of the loop in case of timeout

In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender. Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-38671 is a Linux kernel reliability flaw in the Qualcomm QUP I2C driver. A buggy or malicious I2C client can keep the bus active and cause the kernel to hang instead of timing out cleanly. This is primarily a denial-of-service risk for affected Linux systems with this hardware path.

Executive priority

Treat as a targeted availability risk, not a broad internet-facing emergency. Patch affected kernel tracks through normal urgent maintenance, with higher priority for appliances or operational technology where device hangs create business disruption.

Technical view

The vulnerable i2c-qup timeout path set an error return but did not exit the wait loop when the bus stayed active. The fix changes the logic to break out and return -ETIMEDOUT to the caller. The source cites observation during long testing with a PCA953x GPIO expander.

Likely exposure

Exposure is most likely on Linux systems using the Qualcomm QUP I2C controller and affected kernel builds. General Linux assets without this driver or attached I2C client path are less likely exposed. Exact affected ranges should be confirmed against kernel stable commits and distribution advisories.

Exploitation context

The bundle does not show KEV listing or public active exploitation. The described trigger is a malicious or buggy I2C client holding the bus active, causing a kernel hang. Evidence supports denial of service, not privilege escalation or remote network compromise.

Researcher notes

Evidence is limited to the CVE text, kernel stable commits, and Debian LTS references. No CVSS, CWE, exploit proof, or active exploitation claim is provided. The key research question is whether the asset uses i2c-qup with controllable or failure-prone I2C clients.

Mitigation direction

  • Apply kernel updates that include the referenced stable fixes.
  • Use distribution advisories, including Debian LTS notices, to identify packaged fixed versions.
  • Prioritize embedded, mobile, or appliance fleets using Qualcomm QUP I2C hardware.
  • If updates are delayed, monitor affected devices for I2C-related hangs or watchdog resets.

Validation and detection

  • Inventory running kernel versions and enabled i2c-qup driver usage.
  • Map vendor kernel packages to the cited upstream stable commits.
  • Review hardware bills of materials for Qualcomm QUP I2C controllers and PCA953x-like expanders.
  • Check system logs for I2C timeout, bus-active, or unexplained kernel hang symptoms.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38671 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfbfab1ab065879370541caf0e514987368eb41b2, fbfab1ab065879370541caf0e514987368eb41b2, fbfab1ab065879370541caf0e514987368eb41b2, fbfab1ab065879370541caf0e514987368eb41b2, fbfab1ab065879370541caf0e514987368eb41b2, fbfab1ab065879370541caf0e514987368eb41b2, fbfab1ab065879370541caf0e514987368eb41b2, fbfab1ab065879370541caf0e514987368eb41b2unaffected
LinuxLinux4.17, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.148, 6.6.101, 6.12.41, 6.15.9, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.