LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47425: i2c: acpi: fix resource leak in reconfiguration device addition

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter which is never released which will result in a reference count leak and render the adapter unremovable. Make sure to put the adapter after creating the client in the same manner that we do for OF. [wsa: fixed title]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a resource-leak bug in ACPI I2C device reconfiguration. The kernel can keep an extra reference to an I2C adapter, making that adapter unremovable. The public sources do not show code execution, privilege escalation, data theft, or active exploitation.

Executive priority

Treat this as a low-urgency kernel maintenance item unless affected hardware workflows are business-critical. Include it in normal kernel patch cycles and prioritize specialized embedded, laptop, or appliance fleets using ACPI I2C devices.

Technical view

acpi_i2c_find_adapter_by_handle() calls bus_find_device(), which takes a device reference. The vulnerable path did not release that reference after client creation, causing a reference-count leak. The fix mirrors the OF path by putting the adapter after creating the I2C client.

Likely exposure

Exposure is most relevant to Linux systems using ACPI-managed I2C devices and runtime device reconfiguration. General server exposure appears limited unless hardware, firmware, or operational workflows exercise this path.

Exploitation context

CISA KEV status is false in the source bundle, and no cited source reports active exploitation. The documented consequence is an unremovable adapter from leaked references, which is primarily an availability or operations concern.

Researcher notes

The public record lacks CVSS, CWE, and exploit evidence. Analysis should stay close to the reference-count leak described by the kernel fix. Avoid broad claims beyond adapter unremovability unless vendor advisories provide more impact detail.

Mitigation direction

  • Update to a vendor kernel containing the referenced upstream stable fixes.
  • Check distribution advisories because kernels may backport fixes without changing headline version numbers.
  • Prioritize systems using ACPI I2C hardware or device hotplug/reconfiguration workflows.
  • If patching is delayed, monitor affected hosts for I2C adapter removal failures.

Validation and detection

  • Inventory Linux kernel versions and map them to vendor fixed builds.
  • Confirm whether deployed systems use ACPI-managed I2C adapters.
  • Verify the kernel source or package includes the adapter reference release fix.
  • Review operational logs for repeated I2C reconfiguration or adapter removal failures.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47425 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux525e6fabeae286848592363bda13bc34b59bb5ac, 525e6fabeae286848592363bda13bc34b59bb5ac, 525e6fabeae286848592363bda13bc34b59bb5ac, 525e6fabeae286848592363bda13bc34b59bb5ac, 525e6fabeae286848592363bda13bc34b59bb5ac, 525e6fabeae286848592363bda13bc34b59bb5acunaffected
LinuxLinux4.8, 0, 4.14.251, 4.19.211, 5.4.153, 5.10.73, 5.14.12, 5.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.