LiveActive security incident?Get immediate response
CVE Record

CVE-2019-25162: i2c: Fix a potential use after free

In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2019-25162 is a Linux kernel I2C use-after-free bug. The kernel could free an adapter structure before later code finished using it. The public record does not provide CVSS, impact details, or evidence of active exploitation, so urgency depends on whether your systems run affected kernel builds and use relevant I2C functionality.

Executive priority

Handle through normal kernel vulnerability management unless local context raises impact. There is no sourced active exploitation or severity score, but kernel memory-safety defects can carry operational risk on exposed or hard-to-patch platforms.

Technical view

The fix moves put_device() later so the I2C adapter object remains valid until all uses complete. The CVE lists Linux as affected and references stable kernel commits carrying the fix. The source bundle does not describe trigger conditions, attacker privileges, crashability, privilege escalation, or remote reachability.

Likely exposure

Exposure is most likely on Linux systems using affected kernel versions or vendor kernels without the referenced stable fix. Embedded, appliance, hardware-management, and other systems with I2C device support may be relevant. Distribution backports can change version-based conclusions, so kernel provenance matters.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation or public weaponization. It also does not describe a reliable trigger path. Treat exploitation likelihood as unconfirmed, not absent.

Researcher notes

Evidence is limited to the CVE description and kernel stable references. The key technical fact is lifetime ordering around the I2C adapter structure. Do not assume attack vector, required privileges, or impact without further vendor or upstream analysis.

Mitigation direction

  • Check Linux distribution or device vendor guidance for CVE-2019-25162.
  • Update to a kernel build containing the referenced stable fix.
  • Confirm vendor backport status before relying on version strings alone.
  • Prioritize systems where kernel faults affect availability or safety.
  • Track fleet exceptions until patched or vendor-declared unaffected.

Validation and detection

  • Inventory running kernel builds across servers, appliances, and embedded devices.
  • Compare each build against vendor advisories and fixed stable commits.
  • Confirm whether relevant I2C kernel code is present or enabled.
  • Review patch notes for the referenced I2C use-after-free fix.
  • Document systems declared unaffected by vendor backport evidence.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-25162 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6, 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6, 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6, 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6, 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6, 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6, 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6, 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6unaffected
LinuxLinux4.3, 0, 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.