CVE-2025-38682
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-11-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-415 | The product calls free() twice on the same memory address. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a double-free bug in the Linux kernel's i2c core subsystem. Specifically, in the function i2c_unregister_device(), the software node's firmware node (fwnode) is released twice due to improper handling after a certain commit. When an i2c_client device has no primary hardware firmware node but has a software firmware node, the software node is treated as primary and gets released twice: once by fwnode_handle_put() and once by device_remove_software_node(), leading to a double free and potential use-after-free errors.
How can this vulnerability impact me? :
This vulnerability can cause a double free and use-after-free condition in the Linux kernel, which may lead to system instability, crashes, or potential exploitation by attackers to execute arbitrary code or cause denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for error messages related to refcount underflow or use-after-free in the i2c_unregister_device function. Specifically, look for log entries similar to: 'refcount_t: underflow; use-after-free' and warnings from refcount_warn_saturate. You can use the command 'dmesg | grep -i refcount' or 'journalctl -k | grep -i refcount' to find such messages in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the double-free issue in i2c_unregister_device, specifically the commit that prevents calling fwnode_handle_put() when the primary fwnode is a software-node. Until the update is applied, avoid unregistering i2c devices that may trigger this condition if possible.