---
id: CVE-2025-38671
title: 'i2c: qup: jump out of the loop in case of timeout'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i2c: qup: jump out of the loop in case of timeout

  Original logic only sets the return value but doesn't jump out of the
  loop if the bus is kept active by a client. Thi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    cbec4406998185e0311ae97dfacc649f9cd79b0b
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    acfa2948be630ad857535cb36153697f3cbf9ca9
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    d05ec13aa3eb868a60dc961b489053a643863ddc
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    c523bfba46c4b4d7676fb050909533a766698ecd
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    0d33913fce67a93c1eb83396c3c9d6b411dcab33
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    42c4471b30fa203249f476dd42321cd7efb7f6a8
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    89459f168b78e5c801dc8b7ad037b62898bc4f57
  - >-
    Linux >= fbfab1ab065879370541caf0e514987368eb41b2 <
    a7982a14b3012527a9583d12525cd0dc9f8d8934
  - Linux 4.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:06:33.438648Z'
published: '2025-08-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:51.616Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38671'
references:
  - url: 'https://git.kernel.org/stable/c/cbec4406998185e0311ae97dfacc649f9cd79b0b'
  - url: 'https://git.kernel.org/stable/c/acfa2948be630ad857535cb36153697f3cbf9ca9'
  - url: 'https://git.kernel.org/stable/c/d05ec13aa3eb868a60dc961b489053a643863ddc'
  - url: 'https://git.kernel.org/stable/c/c523bfba46c4b4d7676fb050909533a766698ecd'
  - url: 'https://git.kernel.org/stable/c/0d33913fce67a93c1eb83396c3c9d6b411dcab33'
  - url: 'https://git.kernel.org/stable/c/42c4471b30fa203249f476dd42321cd7efb7f6a8'
  - url: 'https://git.kernel.org/stable/c/89459f168b78e5c801dc8b7ad037b62898bc4f57'
  - url: 'https://git.kernel.org/stable/c/a7982a14b3012527a9583d12525cd0dc9f8d8934'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.06307
ingestedAt: '2026-11-05T22:38:32.007Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

i2c: qup: jump out of the loop in case of timeout

Original logic only sets the return value but doesn't jump out of the
loop if the bus is kept active by a client. This is not expected. A
malicious or buggy i2c client can hang the kernel in this case and
should be avoided. This is observed during a long time test with a
PCA953x GPIO extender.

Fix it by changing the logic to not only sets the return value, but also
jumps out of the loop and return to the caller with -ETIMEDOUT.

## Affected

- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < cbec4406998185e0311ae97dfacc649f9cd79b0b`
- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < acfa2948be630ad857535cb36153697f3cbf9ca9`
- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < d05ec13aa3eb868a60dc961b489053a643863ddc`
- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < c523bfba46c4b4d7676fb050909533a766698ecd`
- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < 0d33913fce67a93c1eb83396c3c9d6b411dcab33`
- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < 42c4471b30fa203249f476dd42321cd7efb7f6a8`
- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < 89459f168b78e5c801dc8b7ad037b62898bc4f57`
- `Linux >= fbfab1ab065879370541caf0e514987368eb41b2 < a7982a14b3012527a9583d12525cd0dc9f8d8934`
- `Linux 4.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.