CVE-2025-21878 is a vulnerability identified in the Linux kernel's i2c subsystem, specifically affecting the npcm i2c driver. The issue arises during the handling of interrupts related to the i2c module. When the Baseboard Management Controller (BMC) system performs a warm reboot in the middle of an i2c transaction, the i2c module retains its status without resetting properly. This stale status causes the i2c interrupt request (IRQ) handler to be continuously triggered after the system reboot, as the interrupt enable bit remains set and the status bit is read-only, preventing proper clearing. The continuous triggering of the IRQ handler leads to a soft lockup condition, where the CPU becomes stuck processing interrupts for an extended period (reported as 26 seconds in the log), eventually causing the kernel to panic and the system to reboot again. The root cause is that the interrupt enable bit is not disabled before the devm_request_irq function is called during the driver initialization, which leads to the persistent interrupt state. The fix involves disabling the interrupt enable bit before requesting the IRQ to ensure the interrupt line is properly reset and does not cause repeated triggers. This vulnerability affects Linux kernel versions identified by the commit hash 56a1485b102ed1cd5a4af8e87ed794699fd1cad2 and likely impacts systems using the npcm i2c driver, which is common in embedded and server BMC environments. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, especially those operating data centers, telecommunications infrastructure, or industrial control systems that rely on Linux-based BMCs or embedded systems using the npcm i2c driver, this vulnerability poses a risk of system instability and downtime. The soft lockup and kernel panic can cause unexpected reboots, leading to service interruptions, potential data loss, and degraded operational reliability. Critical infrastructure sectors such as energy, manufacturing, and finance, which often deploy Linux-based hardware management controllers, may experience disruptions if affected devices are not patched. The inability to properly reset the i2c interrupt status could also complicate incident response and recovery processes. While this vulnerability does not directly lead to remote code execution or data breach, the denial-of-service impact through repeated system crashes can have significant operational and financial consequences. Additionally, the vulnerability may affect supply chain components that use the npcm i2c driver, amplifying the risk across multiple organizations.

European organizations should prioritize updating their Linux kernel versions to include the patch that disables the interrupt enable bit before calling devm_request_irq in the npcm i2c driver. Since the vulnerability is related to the kernel driver initialization, applying the latest stable kernel releases or vendor-provided patches that address CVE-2025-21878 is critical. For systems where immediate patching is not feasible, organizations should implement monitoring for soft lockup warnings and kernel panics related to i2c interrupts to enable rapid detection and response. Additionally, reviewing and hardening BMC firmware update procedures and ensuring secure reboot processes can reduce the risk of triggering this condition. Organizations should also audit their hardware inventory to identify devices using the npcm i2c driver and coordinate with hardware vendors for firmware or kernel updates. In environments with high availability requirements, deploying redundant systems or failover mechanisms can mitigate the impact of unexpected reboots caused by this vulnerability.