Skip to content
Fencer Vulns
medium 5.5

CVE-2025-23149 json

tpm: do not start chip while suspended

published 2025-05-01 18 mo ago modified 2026-11-05 3 d ago also EUVD-2025-13096

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

tpm: do not start chip while suspended

Checking TPM_CHIP_FLAG_SUSPENDED after the call to tpm_find_get_ops() can lead to a spurious tpm_chip_start() call:

[35985.503771] i2c i2c-1: Transfer while suspended [35985.503796] WARNING: CPU: 0 PID: 74 at drivers/i2c/i2c-core.h:56 __i2c_transfer+0xbe/0x810 [35985.503802] Modules linked in: [35985.503808] CPU: 0 UID: 0 PID: 74 Comm: hwrng Tainted: G W 6.13.0-next-20250203-00005-gfa0cb5642941 #19 9c3d7f78192f2d38e32010ac9c90fdc71109ef6f [35985.503814] Tainted: [W]=WARN [35985.503817] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023 [35985.503819] RIP: 0010:__i2c_transfer+0xbe/0x810 [35985.503825] Code: 30 01 00 00 4c 89 f7 e8 40 fe d8 ff 48 8b 93 80 01 00 00 48 85 d2 75 03 49 8b 16 48 c7 c7 0a fb 7c a7 48 89 c6 e8 32 ad b0 fe <0f> 0b b8 94 ff ff ff e9 33 04 00 00 be 02 00 00 00 83 fd 02 0f 5 [35985.503828] RSP: 0018:ffffa106c0333d30 EFLAGS: 00010246 [35985.503833] RAX: 074ba64aa20f7000 RBX: ffff8aa4c1167120 RCX: 0000000000000000 [35985.503836] RDX: 0000000000000000 RSI: ffffffffa77ab0e4 RDI: 0000000000000001 [35985.503838] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [35985.503841] R10: 0000000000000004 R11: 00000001000313d5 R12: ffff8aa4c10f1820 [35985.503843] R13: ffff8aa4c0e243c0 R14: ffff8aa4c1167250 R15: ffff8aa4c1167120 [35985.503846] FS: 0000000000000000(0000) GS:ffff8aa4eae00000(0000) knlGS:0000000000000000 [35985.503849] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [35985.503852] CR2: 00007fab0aaf1000 CR3: 0000000105328000 CR4: 00000000003506f0 [35985.503855] Call Trace: [35985.503859] <TASK> [35985.503863] ? __warn+0xd4/0x260 [35985.503868] ? __i2c_transfer+0xbe/0x810 [35985.503874] ? report_bug+0xf3/0x210 [35985.503882] ? handle_bug+0x63/0xb0 [35985.503887] ? exc_invalid_op+0x16/0x50 [35985.503892] ? asm_exc_invalid_op+0x16/0x20 [35985.503904] ? __i2c_transfer+0xbe/0x810 [35985.503913] tpm_cr50_i2c_transfer_message+0x24/0xf0 [35985.503920] tpm_cr50_i2c_read+0x8e/0x120 [35985.503928] tpm_cr50_request_locality+0x75/0x170 [35985.503935] tpm_chip_start+0x116/0x160 [35985.503942] tpm_try_get_ops+0x57/0x90 [35985.503948] tpm_find_get_ops+0x26/0xd0 [35985.503955] tpm_get_random+0x2d/0x80

Don't move forward with tpm_chip_start() inside tpm_try_get_ops(), unless TPM_CHIP_FLAG_SUSPENDED is not set. tpm_find_get_ops() will return NULL in such a failure case.

Patch / fix

  • Linux Linux 6.6.88, 6.12, 6.12.24, 6.13.12, 6.14.3, 6.15
  • linux Debian 14, Debian 13 6.12.25-1

debian advisories DEBIAN-CVE-2025-23149

  • linux Ubuntu 24.04 LTS 6.8.0-100.100
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1046.49
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1047.50
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1043.48
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1044.44
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1046.52
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1030.33
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1047.51

ubuntu advisories UBUNTU-CVE-2025-23149

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.28.coco15sp6.1
  • kernel-syms-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.28.coco15sp6.1
  • kernel-coco_debug SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.28.coco15sp6.1
  • kernel-source-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.28.coco15sp6.1
  • kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.8.1
  • kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.8.1
  • kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.8.1
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.6.1

suse advisories SUSE-SU-2025:02923-1SUSE-SU-2025:02334-1SUSE-SU-2025:02333-1SUSE-SU-2025:02307-1SUSE-SU-2025:02254-1SUSE-SU-2025:02000-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-23149 updated cvss 6.0

kernel: tpm: do not start chip while suspended

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 d ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.