CVE-2025-39960: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-39960 is a vulnerability in the Linux kernel's GPIO ACPI interface discovered and disclosed on October 9, 2025. The issue affects the gpiolib ACPI subsystem where uninitialized acpigpioinfo structures are passed to _acpifindgpio() function, impacting the i2chid_cpi driver functionality (NVD, RedHat).

The vulnerability stems from commit 7c010d463372 ("gpiolib: acpi: Make sure we fill struct acpigpioinfo") where uninitialized acpigpioinfo structures are passed to _acpifindgpio(). Later in the call stack, info->quirks is used in acpipopulategpiolookup without proper initialization. This results in the i2chidcpi driver failing with error -22 when HID over i2c is not provided with an Int IRQ (NVD).

The vulnerability causes operational failures in the i2chidcpi driver, preventing proper initialization of HID devices over i2c interfaces. This is evidenced by the error message "HID over i2c has not been provided an Int IRQ" and subsequent driver probe failure (RedHat).

The issue has been resolved by implementing proper initialization of the acpigpioinfo structure before passing it to _acpifind_gpio(). The fix ensures that all required fields, including quirks, are properly initialized before use (NVD).