CVE-2025-21878

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i2c: npcm: disable interrupt enable bit before devm_request_irq

The customer reports that there is a soft lockup issue related to

the i2c driver. After checking, the i2c module was doing a tx transfer

and the bmc machine reboots in the middle of the i2c transaction, the i2c

module keeps the status without being reset.

Due to such an i2c module status, the i2c irq handler keeps getting

triggered since the i2c irq handler is registered in the kernel booting

process after the bmc machine is doing a warm rebooting.

The continuous triggering is stopped by the soft lockup watchdog timer.

Disable the interrupt enable bit in the i2c module before calling

devm_request_irq to fix this issue since the i2c relative status bit

is read-only.

Here is the soft lockup log.

[ 28.176395] watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [swapper/0:1]

[ 28.183351] Modules linked in:

[ 28.186407] CPU: 0 PID: 1 Comm: swapper/0 No

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References