CVE-2021-47425: i2c: acpi: fix resource leak in reconfiguration device addition

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-21 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter which is never released which will result in a reference count leak and render the adapter unremovable. Make sure to put the adapter after creating the client in the same manner that we do for OF. [wsa: fixed title]

Affected products

Linux kernel: from 4.8 before 4.14.251; from 4.15 before 4.19.211; from 4.20 before 5.4.153; from 5.5 before 5.10.73; from 5.11 before 5.14.12; 5.15-rc1, 5.15-rc2, 5.15-rc3, 5.15-rc4 — fixed in 4.14.251, 4.19.211, 5.10.73, 5.14.12, 5.4.153

How to fix

Upgrade to a fixed version: Linux kernel 4.14.251, 4.19.211, 5.10.73, 5.14.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47425 or the next vulnerability affects your stack