CVE-2026-80930: tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
In the Linux kernel, the following vulnerability has been resolved:
tpm: tpmi2cnuvoton: disable IRQ on wait timeout
i2cnuvotonwaitforstat() enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the function returns without balancing the enableirq() call.
Disable the IRQ before leaving the failed wait path. Also preserve an interrupted wait's original error code instead of converting it to -ETIMEDOUT inside the helper.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's tpm_i2c_nuvoton driver are relevant. The issue occurs when the driver's status-wait operation enables an IRQ and the wait then times out or is interrupted before the interrupt handler reports a status change.
What conditions trigger the faulty behavior?
A status-change wait must fail after the driver has enabled its IRQ, either because the wait times out or because it is interrupted before the interrupt handler runs. The failure path previously returned without disabling the IRQ.
What is the mitigation if the fix cannot be deployed immediately?
The provided data does not describe a configuration workaround. The corrective change is to disable the IRQ on failed wait paths and preserve the original error for interrupted waits.