CVE-2025-21902

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

acpi: typec: ucsi: Introduce a ->poll_cci method

For the ACPI backend of UCSI the UCSI "registers" are just a memory copy

of the register values in an opregion. The ACPI implementation in the

BIOS ensures that the opregion contents are synced to the embedded

controller and it ensures that the registers (in particular CCI) are

synced back to the opregion on notifications. While there is an ACPI call

that syncs the actual registers to the opregion there is rarely a need to

do this and on some ACPI implementations it actually breaks in various

interesting ways.

The only reason to force a sync from the embedded controller is to poll

CCI while notifications are disabled. Only the ucsi core knows if this

is the case and guessing based on the current command is suboptimal, i.e.

leading to the following spurious assertion splat:

WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References