CVE-2025-38682— i2c: core: Fix double-free of fwnode in i2c_unregister_device()
Possible ATT&CK Techniques 1AI
T1200.002Affected Version Matrix 6
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-38682
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
i2c: core: Fix double-free of fwnode in i2c_unregister_device()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i2c: core: Fix double-free of fwnode in i2c_unregister_device() Before commit df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device"), i2c_unregister_device() only called fwnode_handle_put() on of_node-s in the form of calling of_node_put(client->dev.of_node). But after this commit the i2c_client's fwnode now unconditionally gets fwnode_handle_put() on it. When the i2c_client has no primary (ACPI / OF) fwnode but it does have a software fwnode, the software-node will be the primary node and fwnode_handle_put() will put() it. But for the software fwnode device_remove_software_node() will also put() it leading to a double free: [ 82.665598] ------------[ cut here ]------------ [ 82.665609] refcount_t: underflow; use-after-free. [ 82.665808] WARNING: CPU: 3 PID: 1502 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x11 ... [ 82.666830] RIP: 0010:refcount_warn_saturate+0xba/0x110 ... [ 82.666962] <TASK> [ 82.666971] i2c_unregister_device+0x60/0x90 Fix this by not calling fwnode_handle_put() when the primary fwnode is a software-node.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于双重释放fwnode，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-38682
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-38682
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-38682 (1)
Same Patch Batch · Linux · 2025-09-04 · 52 CVEs total
| CVE-2025-38708 | 9.8 CRITICAL | drbd: add missing kref_get in handle_write_conflicts |
| CVE-2025-38724 | 9.8 CRITICAL | nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() |
| CVE-2025-38728 | 9.1 CRITICAL | smb3: fix for slab out of bounds on mount to ksmbd |
| CVE-2025-38688 | 8.8 HIGH | iommufd: Prevent ALIGN() overflow |
| CVE-2025-38697 | 7.8 HIGH | jfs: upper bound check of tree index in dbAllocAG |
| CVE-2025-38722 | 7.8 HIGH | habanalabs: fix UAF in export_dmabuf() |
| CVE-2025-38685 | 7.8 HIGH | fbdev: Fix vmalloc out-of-bounds write in fast_imageblit |
| CVE-2025-38718 | 7.8 HIGH | sctp: linearize cloned gso packets in sctp_rcv |
| CVE-2025-38717 | 7.8 HIGH | net: kcm: Fix race condition in kcm_unattach() |
| CVE-2025-38715 | 7.8 HIGH | hfs: fix slab-out-of-bounds in hfs_bnode_read() |
| CVE-2025-38710 | 7.8 HIGH | gfs2: Validate i_depth for exhash directories |
| CVE-2025-38730 | 7.8 HIGH | io_uring/net: commit partial buffers on retry |
| CVE-2025-38703 | 7.8 HIGH | drm/xe: Make dma-fences compliant with the safe access rules |
| CVE-2025-38714 | 7.8 HIGH | hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() |
| CVE-2025-38679 | 7.3 HIGH | media: venus: Fix OOB read due to missing payload bound check |
| CVE-2025-38687 | 7.3 HIGH | comedi: fix race between polling and detaching |
| CVE-2025-38713 | 7.1 HIGH | hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() |
| CVE-2025-38707 | 7.1 HIGH | fs/ntfs3: Add sanity check for file name |
| CVE-2025-38681 | mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() | |
| CVE-2025-38694 | media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() |
Showing top 20 of 52 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ - CVE-2026-64603
platform/x86: intel-hid: Protect ACPI notify handler against - CVE-2026-64601
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_
Same vendor: Linux
- CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ - CVE-2026-64603
platform/x86: intel-hid: Protect ACPI notify handler against - CVE-2026-64601
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_
V. Comments for CVE-2025-38682
No comments yet