Read the docs
TI-2025-15852 Aliases CVE-2025-21902GHSA-w69j-ppp7-83pp

acpi: typec: ucsi: Introduce a ->poll_cci method

Priority LOW 24Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need to do this and on some ACPI implementations it actually breaks in various interesting ways. The only reason to force a sync from the embedded controller is to poll CCI while notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current command is suboptimal, i.e. leading to the following spurious assertion splat: WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi] RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] Call Trace: <TASK> ucsi_init_work+0x3c/0xac0 [typec_ucsi] process_one_work+0x179/0x330 worker_thread+0x252/0x390 kthread+0xd2/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Thus introduce a ->poll_cci() method that works like ->read_cci() with an additional forced sync and document that this should be used when polling with notifications disabled. For all other backends that presumably don't have this issue use the same implementation for both methods.

Why it matters now

EPSS 0.00209 11th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.12.19, 6.13.7, 6.14Red Hat: 2 advisoriesRed Hat: 10 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.12.5 to before 6.12.196.12.19Patch availableCNA
LinuxLinux6.13 and later6.12.19, 6.13.7, 6.14Patch availableCNA
  • Linux VendorLinux Affected 6.12.5 to before 6.12.19 Fixed in 6.12.19 Patch available CNA
  • Linux VendorLinux Affected 6.13 and later Fixed in 6.12.19, 6.13.7, 6.14 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*6.12.5 to before 6.12.19; 6.13 to before 6.13.7VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*6.14 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*6.14 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*6.14 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*6.14 rc4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*6.14 rc5VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 6.12.5 to before 6.12.19; 6.13 to before 6.13.7 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:* Versions 6.14 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:* Versions 6.14 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:* Versions 6.14 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:* Versions 6.14 rc4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:* Versions 6.14 rc5 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.12.19
  • Fix · CNA Linux (Linux) Fixed in 6.12.19, 6.13.7, 6.14

Red Hat 2 advisories

  • RHSA-2025:20518 Released 2025-11-11 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-611.5.1.el9_7, kernel-64k-debug-devel-matched-5.14.0-611.5.1.el9_7, kernel-64k-devel-5.14.0-611.5.1.el9_7 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-611.5.1.el9_7, kernel-64k-5.14.0-611.5.1.el9_7, kernel-64k-core-5.14.0-611.5.1.el9_7 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-611.5.1.el9_7, libperf-5.14.0-611.5.1.el9_7
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-611.5.1.el9_7, kernel-rt-64k-5.14.0-611.5.1.el9_7, kernel-rt-64k-core-5.14.0-611.5.1.el9_7 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-611.5.1.el9_7, kernel-rt-core-5.14.0-611.5.1.el9_7, kernel-rt-debug-5.14.0-611.5.1.el9_7 +9
  • RHSA-2025:20095 Released 2025-11-11 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-124.8.1.el10_1, kernel-64k-debug-devel-matched-6.12.0-124.8.1.el10_1, kernel-64k-devel-6.12.0-124.8.1.el10_1 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-124.8.1.el10_1, kernel-64k-6.12.0-124.8.1.el10_1, kernel-64k-core-6.12.0-124.8.1.el10_1 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-124.8.1.el10_1, libperf-6.12.0-124.8.1.el10_1
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-124.8.1.el10_1, kernel-rt-64k-6.12.0-124.8.1.el10_1, kernel-rt-64k-core-6.12.0-124.8.1.el10_1 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-124.8.1.el10_1, kernel-rt-core-6.12.0-124.8.1.el10_1, kernel-rt-debug-6.12.0-124.8.1.el10_1 +9

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:20095
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:20518
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:20095
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:20518
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:20095
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:20518
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2025:20095
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2025:20518
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2025:20095
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2025:20518
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-21902
  2. 2026-10-03 Alias added: GHSA-w69j-ppp7-83pp

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources