CVE-2025-21902 (GCVE-0-2025-21902)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:40 – Updated: 2026-05-23 15:57
VLAI
Title
acpi: typec: ucsi: Introduce a ->poll_cci method
Summary
In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need to do this and on some ACPI implementations it actually breaks in various interesting ways. The only reason to force a sync from the embedded controller is to poll CCI while notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current command is suboptimal, i.e. leading to the following spurious assertion splat: WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi] RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] Call Trace: <TASK> ucsi_init_work+0x3c/0xac0 [typec_ucsi] process_one_work+0x179/0x330 worker_thread+0x252/0x390 kthread+0xd2/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Thus introduce a ->poll_cci() method that works like ->read_cci() with an additional forced sync and document that this should be used when polling with notifications disabled. For all other backends that presumably don't have this issue use the same implementation for both methods.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c0ca6fd5f6ebde8fc0df8bb5c32629d1284f60d0 , < 012b98cdb54c7d47743ee7fc402fa23f2d90529a (git)
Affected: fa48d7e81624efdf398b990a9049e9cd75a5aead , < 1aec5c9066965ac0984e385bbc31455ae31cbffc (git)
Affected: fa48d7e81624efdf398b990a9049e9cd75a5aead , < 976e7e9bdc7719a023a4ecccd2e3daec9ab20a40 (git)
Affected: 6.12.5 , < 6.12.19 (semver)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.12.19 , ≤ 6.12.* (semver)
Unaffected: 6.13.7 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi.c",
            "drivers/usb/typec/ucsi/ucsi.h",
            "drivers/usb/typec/ucsi/ucsi_acpi.c",
            "drivers/usb/typec/ucsi/ucsi_ccg.c",
            "drivers/usb/typec/ucsi/ucsi_glink.c",
            "drivers/usb/typec/ucsi/ucsi_stm32g0.c",
            "drivers/usb/typec/ucsi/ucsi_yoga_c630.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "012b98cdb54c7d47743ee7fc402fa23f2d90529a",
              "status": "affected",
              "version": "c0ca6fd5f6ebde8fc0df8bb5c32629d1284f60d0",
              "versionType": "git"
            },
            {
              "lessThan": "1aec5c9066965ac0984e385bbc31455ae31cbffc",
              "status": "affected",
              "version": "fa48d7e81624efdf398b990a9049e9cd75a5aead",
              "versionType": "git"
            },
            {
              "lessThan": "976e7e9bdc7719a023a4ecccd2e3daec9ab20a40",
              "status": "affected",
              "version": "fa48d7e81624efdf398b990a9049e9cd75a5aead",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.19",
              "status": "affected",
              "version": "6.12.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi.c",
            "drivers/usb/typec/ucsi/ucsi.h",
            "drivers/usb/typec/ucsi/ucsi_acpi.c",
            "drivers/usb/typec/ucsi/ucsi_ccg.c",
            "drivers/usb/typec/ucsi/ucsi_glink.c",
            "drivers/usb/typec/ucsi/ucsi_stm32g0.c",
            "drivers/usb/typec/ucsi/ucsi_yoga_c630.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.12.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nacpi: typec: ucsi: Introduce a -\u003epoll_cci method\n\nFor the ACPI backend of UCSI the UCSI \"registers\" are just a memory copy\nof the register values in an opregion. The ACPI implementation in the\nBIOS ensures that the opregion contents are synced to the embedded\ncontroller and it ensures that the registers (in particular CCI) are\nsynced back to the opregion on notifications. While there is an ACPI call\nthat syncs the actual registers to the opregion there is rarely a need to\ndo this and on some ACPI implementations it actually breaks in various\ninteresting ways.\n\nThe only reason to force a sync from the embedded controller is to poll\nCCI while notifications are disabled. Only the ucsi core knows if this\nis the case and guessing based on the current command is suboptimal, i.e.\nleading to the following spurious assertion splat:\n\nWARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi]\nCPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1\nHardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023\nWorkqueue: events_long ucsi_init_work [typec_ucsi]\nRIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi]\nCall Trace:\n \u003cTASK\u003e\n ucsi_init_work+0x3c/0xac0 [typec_ucsi]\n process_one_work+0x179/0x330\n worker_thread+0x252/0x390\n kthread+0xd2/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nThus introduce a -\u003epoll_cci() method that works like -\u003eread_cci() with an\nadditional forced sync and document that this should be used when polling\nwith notifications disabled. For all other backends that presumably don\u0027t\nhave this issue use the same implementation for both methods."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:57:24.856Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/012b98cdb54c7d47743ee7fc402fa23f2d90529a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1aec5c9066965ac0984e385bbc31455ae31cbffc"
        },
        {
          "url": "https://git.kernel.org/stable/c/976e7e9bdc7719a023a4ecccd2e3daec9ab20a40"
        }
      ],
      "title": "acpi: typec: ucsi: Introduce a -\u003epoll_cci method",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21902",
    "datePublished": "2025-04-01T15:40:44.425Z",
    "dateReserved": "2024-12-29T08:45:45.785Z",
    "dateUpdated": "2026-05-23T15:57:24.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21902",
      "date": "2026-10-02",
      "epss": "0.00205",
      "percentile": "0.09464"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/typec/ucsi/ucsi.c",
                  "drivers/usb/typec/ucsi/ucsi.h",
                  "drivers/usb/typec/ucsi/ucsi_acpi.c",
                  "drivers/usb/typec/ucsi/ucsi_ccg.c",
                  "drivers/usb/typec/ucsi/ucsi_glink.c",
                  "drivers/usb/typec/ucsi/ucsi_stm32g0.c",
                  "drivers/usb/typec/ucsi/ucsi_yoga_c630.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "012b98cdb54c7d47743ee7fc402fa23f2d90529a",
                    "status": "affected",
                    "version": "c0ca6fd5f6ebde8fc0df8bb5c32629d1284f60d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1aec5c9066965ac0984e385bbc31455ae31cbffc",
                    "status": "affected",
                    "version": "fa48d7e81624efdf398b990a9049e9cd75a5aead",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "976e7e9bdc7719a023a4ecccd2e3daec9ab20a40",
                    "status": "affected",
                    "version": "fa48d7e81624efdf398b990a9049e9cd75a5aead",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.19",
                    "status": "affected",
                    "version": "6.12.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/typec/ucsi/ucsi.c",
                  "drivers/usb/typec/ucsi/ucsi.h",
                  "drivers/usb/typec/ucsi/ucsi_acpi.c",
                  "drivers/usb/typec/ucsi/ucsi_ccg.c",
                  "drivers/usb/typec/ucsi/ucsi_glink.c",
                  "drivers/usb/typec/ucsi/ucsi_stm32g0.c",
                  "drivers/usb/typec/ucsi/ucsi_yoga_c630.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "32C54FE1-D058-4565-9F5B-4B599C9615BF",
                    "versionEndExcluding": "6.12.19",
                    "versionStartIncluding": "6.12.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "842F5A44-3E71-4546-B4FD-43B0ACE3F32B",
                    "versionEndExcluding": "6.13.7",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nacpi: typec: ucsi: Introduce a -\u003epoll_cci method\n\nFor the ACPI backend of UCSI the UCSI \"registers\" are just a memory copy\nof the register values in an opregion. The ACPI implementation in the\nBIOS ensures that the opregion contents are synced to the embedded\ncontroller and it ensures that the registers (in particular CCI) are\nsynced back to the opregion on notifications. While there is an ACPI call\nthat syncs the actual registers to the opregion there is rarely a need to\ndo this and on some ACPI implementations it actually breaks in various\ninteresting ways.\n\nThe only reason to force a sync from the embedded controller is to poll\nCCI while notifications are disabled. Only the ucsi core knows if this\nis the case and guessing based on the current command is suboptimal, i.e.\nleading to the following spurious assertion splat:\n\nWARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi]\nCPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1\nHardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023\nWorkqueue: events_long ucsi_init_work [typec_ucsi]\nRIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi]\nCall Trace:\n \u003cTASK\u003e\n ucsi_init_work+0x3c/0xac0 [typec_ucsi]\n process_one_work+0x179/0x330\n worker_thread+0x252/0x390\n kthread+0xd2/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nThus introduce a -\u003epoll_cci() method that works like -\u003eread_cci() with an\nadditional forced sync and document that this should be used when polling\nwith notifications disabled. For all other backends that presumably don\u0027t\nhave this issue use the same implementation for both methods."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: acpi: typec: ucsi: Introducir un m\u00e9todo -\u0026gt;poll_cci. Para el backend ACPI de UCSI, los \"registros\" UCSI son simplemente una copia en memoria de los valores de registro en una regi\u00f3n operativa. La implementaci\u00f3n de ACPI en la BIOS garantiza que el contenido de la regi\u00f3n operativa se sincronice con el controlador integrado y que los registros (en particular, CCI) se sincronicen con la regi\u00f3n operativa en las notificaciones. Si bien existe una llamada ACPI que sincroniza los registros con la regi\u00f3n operativa, rara vez es necesario hacerlo y, en algunas implementaciones de ACPI, falla de diversas maneras interesantes. La \u00fanica raz\u00f3n para forzar una sincronizaci\u00f3n desde el controlador integrado es sondear CCI mientras las notificaciones est\u00e1n deshabilitadas. Solo el n\u00facleo ucsi sabe si este es el caso y las suposiciones basadas en el comando actual no son \u00f3ptimas, es decir, conducen al siguiente mensaje de afirmaci\u00f3n falsa: ADVERTENCIA: CPU: 3 PID: 76 en drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 No contaminado 6.12.11-200.fc41.x86_64 #1 Nombre del hardware: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 17/03/2023 Cola de trabajo: events_long ucsi_init_work [typec_ucsi] RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] Seguimiento de llamadas:  ucsi_init_work+0x3c/0xac0 [typec_ucsi] process_one_work+0x179/0x330 workers_thread+0x252/0x390 kthread+0xd2/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30  Por lo tanto, introduzca un m\u00e9todo -\u0026gt;poll_cci() que funcione como -\u0026gt;read_cci() con una sincronizaci\u00f3n forzada adicional y documente que debe usarse al sondear con las notificaciones deshabilitadas. Para todos los dem\u00e1s backends que presumiblemente no presenten este problema, utilice la misma implementaci\u00f3n para ambos m\u00e9todos."
          }
        ],
        "id": "CVE-2025-21902",
        "lastModified": "2026-06-17T08:44:34.167",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-04-01T16:15:20.650",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/012b98cdb54c7d47743ee7fc402fa23f2d90529a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1aec5c9066965ac0984e385bbc31455ae31cbffc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/976e7e9bdc7719a023a4ecccd2e3daec9ab20a40"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:19:14+00:00",
      "cve": "CVE-2025-21902",
      "id": "CVE-2025-21902",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: acpi: typec: ucsi: Introduce a -\u003epoll_cci method",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21902.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.