Cloudanix VulnDB

CVE-2026-80930

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in how some computers talk to their built-in security chip can make the system unstable if a brief wait takes too long.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unbalanced enable_irq() call in i2c_nuvoton_wait_for_stat() leaves interrupts enabled after timeout or signal interruption, creating a race condition in IRQ management within the TPM I2C driver.

Why it matters to the business

Linux systems relying on Nuvoton TPM chips over I2C may encounter stability issues or performance degradation from mishandled interrupts, with moderate urgency given recent publication and lack of known exploitation.

How an attack unfolds

An attacker manipulates timing or I2C bus conditions to force a wait timeout or interruption in the TPM driver helper, causing the function to exit without disabling the IRQ and potentially leading to resource exhaustion or denial of service.

How to fix it

Apply the upstream kernel patch that adds disable_irq() before returning from failed wait paths and preserves original error codes; rebuild and deploy updated kernel images.

How to confirm the fix worked

Inspect tpm_i2c_nuvoton.c source for the added disable_irq() call on timeout paths and test TPM operations under simulated delay conditions to confirm balanced IRQ handling.

Typical attack path

  1. Identify systems using tpm_i2c_nuvoton driver
  2. Trigger I2C communication delays or interrupts to hit wait timeout path
  3. Exploit resulting unbalanced IRQ state to induce instability

How to detect it

Review kernel logs for TPM I2C timeout messages or unbalanced IRQ warnings; correlate with process activity involving the TPM driver.

What your security team should do

  • Prioritize kernel updates for affected distributions within standard patch cycles
  • Audit TPM I2C usage in embedded or server deployments
  • Monitor kernel IRQ and TPM driver logs for anomalies

The record

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the function returns without balancing the enable_irq() call. Disable the IRQ before leaving the failed wait path. Also preserve an interrupted wait's original error code instead of converting it to -ETIMEDOUT inside the helper.

Affected packages

Ecosystem Package Introduced Fixed