CVE-2019-25162

i2c: Fix a potential use after free

HIGH

7.8

CVSS Score

Published: February 26, 2024 at 05:20 PM UTC

Updated: August 5, 2026 at 09:24 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.15.0 ≤ v < 4.19.2564.20.0 ≤ v < 5.4.2114.3 ≤ v < 4.14.2914.3 ≤ v < 4.19.2564.3 ≤ v < 5.10.1374.3 ≤ v < 5.15.614.3 ≤ v < 5.18.184.3 ≤ v < 5.19.24.3 ≤ v < 5.4.2114.3 ≤ v < 6.04.3.0 ≤ v < 4.14.2915.11.0 ≤ v < 5.15.615.16.0 ≤ v < 5.18.185.19.0 ≤ v < 5.19.25.5.0 ≤ v < 5.10.1374.3611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6

Vendor states this is fixed in 12b0606000d0828630c033bf0c74c748464fe87d (fixed)

Vendor states this is fixed in 23a191b132cd87f746c62f3dc27da33683d85829 (fixed)

Vendor states this is fixed in 35927d7509ab9bf41896b7e44f639504eae08af7 (fixed)

Vendor states this is fixed in 81cb31756888bb062e92d2dca21cd629d77a46a9 (fixed)

Vendor states this is fixed in 871a1e94929a27bf6e2cd99523865c840bbc2d87 (fixed)

Vendor states this is fixed in e4c72c06c367758a14f227c847f9d623f1994ecf (fixed)

Vendor states this is fixed in e6412ba3b6508bdf9c074d310bf4144afa6aec1a (fixed)

Vendor states this is fixed in e8e1a046cf87c8b1363e5de835114f2779e2aaf4 (fixed)

Vendor states this is fixed in 4.14.291 (unaffected)

Vendor states this is fixed in 4.19.256 (unaffected)

Vendor states this is fixed in 4.3 (unaffected)

Vendor states this is fixed in 5.10.137 (unaffected)

Vendor states this is fixed in 5.15.61 (unaffected)

Vendor states this is fixed in 5.18.18 (unaffected)

Vendor states this is fixed in 5.19.2 (unaffected)

Vendor states this is fixed in 5.4.211 (unaffected)

Vendor states this is fixed in 6.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references