Linux tpm_i2c_nuvoton: unbalanced enable_irq() on wait timeout can wedge TPM access

Impact

i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for a status change and returns without a matching disable when the wait times out or is interrupted. The IRQ enable/disable count is left unbalanced, which can leave the TPM interrupt path in a bad state and break subsequent TPM operations on the node. On a GPU host that gates measured boot, disk unlock or attestation on the TPM, that surfaces as a node that fails to attest rather than as a tenant-reachable exploit. Exposure is limited: only boards using the Nuvoton I2C TPM are affected, and reaching the path requires local TPM access or a timeout under load, not a remote attacker.

Who can reach it

Local only, and mostly a reliability path - a process with access to the TPM device (typically root or an attestation agent) triggering a timed-out or interrupted wait. No remote or tenant-reachable path is described in the record.

What to do

Take the stable kernel update that carries the fix (linked commits) and reboot each affected node; the fix is in the TPM driver, so there is no way to apply it without a kernel reboot. Only nodes whose TPM is a Nuvoton I2C part need the maintenance window - check which TPM driver binds before scheduling drains fleet-wide.

References

Related entries

• Linux kernel ipmi_si: NULL pointer dereference after a failed IPMI interface registrationCVE-2026-81005 · Linux kernel ipmi_si / ipmi_msghandler (failed BMC registration path)Unscored
• Linux kernel ipmi/ipmb: unvalidated write length reads uninitialized stack and underflows block lengthCVE-2026-81007 · Linux kernel IPMI IPMB driver (ipmb_write length validation)Unscored
• Linux kernel ipmi: use-after-free of cmd_rcvr when an IPMI user is destroyedCVE-2026-89486 · Linux kernel IPMI message handler (cmd_rcvr RCU teardown)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored