---
id: CVE-2026-80930
title: 'tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

  i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for the
  interrupt handler to report a status change. If th…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-772
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    007c9e637e0e0b9d946b7f0e8a42f1f1aca48d7a
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    2c9147b2c0d75091ab451c2461d1c91788a7e60b
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    07c2544a47da481043e945322b1bef71cdd7af79
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    b0dc3f18af01ba9f157b7d810cb22d3752d244ef
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    73e89faee1f9b9119fa70b679058b045168ae633
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    cde2d927c29e82380851f209222256c607969a1f
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    aee2296d09f6aeff41db369c6fd2dcaea3ee302c
  - >-
    Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 <
    705c4ed0643366963547b2616d53165f2519c81f
  - Linux 3.13
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:14.086Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80930'
references:
  - url: 'https://git.kernel.org/stable/c/007c9e637e0e0b9d946b7f0e8a42f1f1aca48d7a'
  - url: 'https://git.kernel.org/stable/c/2c9147b2c0d75091ab451c2461d1c91788a7e60b'
  - url: 'https://git.kernel.org/stable/c/07c2544a47da481043e945322b1bef71cdd7af79'
  - url: 'https://git.kernel.org/stable/c/b0dc3f18af01ba9f157b7d810cb22d3752d244ef'
  - url: 'https://git.kernel.org/stable/c/73e89faee1f9b9119fa70b679058b045168ae633'
  - url: 'https://git.kernel.org/stable/c/cde2d927c29e82380851f209222256c607969a1f'
  - url: 'https://git.kernel.org/stable/c/aee2296d09f6aeff41db369c6fd2dcaea3ee302c'
  - url: 'https://git.kernel.org/stable/c/705c4ed0643366963547b2616d53165f2519c81f'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80930.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80930'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532134'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80930'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80930'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80930.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00177
epssPercentile: 0.07152
ingestedAt: '2026-09-14T15:23:07.455Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for the
interrupt handler to report a status change. If the wait times out, or is
interrupted before the handler runs, the function returns without
balancing the enable_irq() call.

Disable the IRQ before leaving the failed wait path. Also preserve an
interrupted wait's original error code instead of converting it to
-ETIMEDOUT inside the helper.

## Affected

- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < 007c9e637e0e0b9d946b7f0e8a42f1f1aca48d7a`
- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < 2c9147b2c0d75091ab451c2461d1c91788a7e60b`
- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < 07c2544a47da481043e945322b1bef71cdd7af79`
- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < b0dc3f18af01ba9f157b7d810cb22d3752d244ef`
- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < 73e89faee1f9b9119fa70b679058b045168ae633`
- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < cde2d927c29e82380851f209222256c607969a1f`
- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < aee2296d09f6aeff41db369c6fd2dcaea3ee302c`
- `Linux >= 4c336e4b1556f4b722ba597bc6e3df786968a600 < 705c4ed0643366963547b2616d53165f2519c81f`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80930.json)