CVE-2019-25162

i2c: Fix a potential use after free

State: Published
Severity: 7.8 High
Published: Feb 26, 2024
Updated: Aug 5, 2026
Reserved: Feb 26, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: Fix a potential use after free

Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free.

[wsa: added comment to the code, added Fixes tag]

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before e6412ba3b6508bdf9c074d310bf4144afa6aec1aAffected 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 23a191b132cd87f746c62f3dc27da33683d85829Affected 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 871a1e94929a27bf6e2cd99523865c840bbc2d87Affected 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 81cb31756888bb062e92d2dca21cd629d77a46a9Affected 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 35927d7509ab9bf41896b7e44f639504eae08af7Affected 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before e8e1a046cf87c8b1363e5de835114f2779e2aaf4Affected 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 12b0606000d0828630c033bf0c74c748464fe87dAffected 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before e4c72c06c367758a14f227c847f9d623f1994ecfAffected
LinuxLinux	4.3Affected before 4.3Not affected 4.14.291 through 4.14.Not affected 4.19.256 through 4.19.Not affected 5.4.211 through 5.4.Not affected 5.10.137 through 5.10.Not affected 5.15.61 through 5.15.Not affected 5.18.18 through 5.18.Not affected 5.19.2 through 5.19.*Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before e6412ba3b6508bdf9c074d310bf4144afa6aec1aAffected
611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 23a191b132cd87f746c62f3dc27da33683d85829Affected
611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 871a1e94929a27bf6e2cd99523865c840bbc2d87Affected
611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 81cb31756888bb062e92d2dca21cd629d77a46a9Affected
611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 35927d7509ab9bf41896b7e44f639504eae08af7Affected
611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before e8e1a046cf87c8b1363e5de835114f2779e2aaf4Affected
611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before 12b0606000d0828630c033bf0c74c748464fe87dAffected
611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 to before e4c72c06c367758a14f227c847f9d623f1994ecfAffected

LinuxLinux

4.3Affected
before 4.3Not affected
4.14.291 through 4.14.*Not affected
4.19.256 through 4.19.*Not affected
5.4.211 through 5.4.*Not affected
5.10.137 through 5.10.*Not affected
5.15.61 through 5.15.*Not affected
5.18.18 through 5.18.*Not affected
5.19.2 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.