CVE-2025-38671

A flaw was found in the Linux kernel's Inter-Integrated Circuit (I2C) Qualcomm Unified Peripheral (QUP) driver. A local attacker, by using a malicious or buggy I2C client, could exploit improper timeout handling. This could lead to the kernel hanging, resulting in a Denial of Service (DoS) for the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, if the i2c qup device is not in use, prevent the i2c_qup kernel module from loading. Create a file /etc/modprobe.d/disable-i2c_qup.conf with the content blacklist i2c_qup. Then, rebuild the initramfs and reboot the system for the changes to take effect. This mitigation is applicable only if i2c qup devices are not essential for system operation, as it will disable functionality related to these devices.

echo "blacklist i2c_qup" > /etc/modprobe.d/disable-i2c_qup.conf
dracut -f
reboot