Linux tpm_i2c_nuvoton: unbalanced enable_irq() on wait timeout can wedge TPM access

UnscoredCVE-2026-80930Firmware, BMC & network fabriccurated

Impact

i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for a status change and returns without a matching disable when the wait times out or is interrupted. The IRQ enable/disable count is left unbalanced, which can leave the TPM interrupt path in a bad state and break subsequent TPM operations on the node. On a GPU host that gates measured boot, disk unlock or attestation on the TPM, that surfaces as a node that fails to attest rather than as a tenant-reachable exploit. Exposure is limited: only boards using the Nuvoton I2C TPM are affected, and reaching the path requires local TPM access or a timeout under load, not a remote attacker.

Who can reach it

Local only, and mostly a reliability path - a process with access to the TPM device (typically root or an attestation agent) triggering a timed-out or interrupted wait. No remote or tenant-reachable path is described in the record.

What to do

Take the stable kernel update that carries the fix (linked commits) and reboot each affected node; the fix is in the TPM driver, so there is no way to apply it without a kernel reboot. Only nodes whose TPM is a Nuvoton I2C part need the maintenance window - check which TPM driver binds before scheduling drains fleet-wide.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80930 https://git.kernel.org/stable/c/705c4ed0643366963547b2616d53165f2519c81f https://git.kernel.org/stable/c/aee2296d09f6aeff41db369c6fd2dcaea3ee302c

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.