CVE-2026-80930 Overview
CVE-2026-80930 is a Linux kernel vulnerability in the tpm_i2c_nuvoton Trusted Platform Module (TPM) driver. The function i2c_nuvoton_wait_for_stat() enables the interrupt request (IRQ) line before waiting for the interrupt handler to report a status change. When the wait times out or is interrupted before the handler runs, the function returns without balancing the prior enable_irq() call. This produces an IRQ enable/disable imbalance in the kernel driver. The upstream fix disables the IRQ on the failed wait path and preserves the interrupted wait's original error code instead of overwriting it with -ETIMEDOUT.
Critical Impact
An unbalanced IRQ enable in the TPM I2C Nuvoton driver can trigger kernel warnings, driver instability, and denial-of-service conditions affecting TPM-dependent security functions such as measured boot and disk encryption.
Affected Products
- Linux kernel builds that include the tpm_i2c_nuvoton driver
- Systems using Nuvoton I2C-attached TPM devices
- Distributions consuming stable kernel branches prior to the referenced fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-80930 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80930
Vulnerability Analysis
The defect resides in i2c_nuvoton_wait_for_stat(), a helper that coordinates status polling with the TPM's interrupt handler. The function calls enable_irq() before blocking on the wait primitive. The handler is expected to disable the IRQ once it observes the status change. If the wait times out or is aborted by a signal before the handler executes, control returns to the caller with the IRQ still enabled. Repeated invocations therefore stack IRQ enable references, eventually producing kernel warnings from the generic IRQ subsystem and disrupting subsequent TPM operations.
The patch adds a disable_irq() on the failure path so enable/disable calls remain balanced. It also stops overwriting an interrupted wait's error code with -ETIMEDOUT, letting callers distinguish signal interruption from an actual timeout.
Root Cause
The root cause is improper resource lifecycle management on error paths within a kernel driver. The helper acquires an IRQ enable reference at entry but only releases it on the success path handled by the interrupt handler, leaving timeout and signal-interruption paths unbalanced.
Attack Vector
The issue is a local reliability and denial-of-service condition rather than a remote code execution flaw. Triggering the imbalance requires conditions where the TPM fails to respond within the driver timeout or where the wait is interrupted, both reachable by workloads that repeatedly exercise the TPM under contention.
No verified exploitation code is available. Technical details are documented in the upstream kernel commits referenced by the CVE, including Kernel Git Commit 007c9e6 and Kernel Git Commit 73e89fa.
Detection Methods for CVE-2026-80930
Indicators of Compromise
- Kernel log warnings referencing Unbalanced enable for IRQ originating from the tpm_i2c_nuvoton driver
- TPM command failures or timeouts logged by userspace consumers such as tpm2-abrmd or tcsd
- Boot-time or runtime measured-boot and integrity-measurement architecture (IMA) errors on affected hosts
Detection Strategies
- Inventory running kernel versions across the fleet and correlate against the fixed commits listed in the NVD references
- Alert on kernel ring buffer messages that reference IRQ imbalance events on hosts with Nuvoton TPM hardware
- Use configuration management to identify systems loading the tpm_i2c_nuvoton module
Monitoring Recommendations
- Forward dmesg and journalctl -k output to a central log platform and build detections for IRQ subsystem warnings
- Monitor TPM service health checks and disk encryption unlock failures that may indicate driver instability
- Track kernel package versions through endpoint telemetry to confirm patched builds are deployed
How to Mitigate CVE-2026-80930
Immediate Actions Required
- Apply the vendor-provided kernel update that includes the upstream fix for tpm_i2c_nuvoton
- Reboot affected systems after patching so the corrected module is loaded
- Prioritize hosts using Nuvoton I2C TPMs for security functions such as full-disk encryption or measured boot
Patch Information
The fix is delivered through multiple stable kernel commits, including 007c9e6, 07c2544, 2c9147b, 705c4ed, 73e89fa, aee2296, b0dc3f1, and cde2d92. Consume the patched kernel package from your distribution as it becomes available.
Workarounds
- No supported workaround exists; unloading the tpm_i2c_nuvoton module disables TPM functionality and is not recommended for systems relying on TPM-backed security
- Reduce contention on the TPM by throttling workloads that issue frequent TPM operations until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
