CVE-2021-47425

What it actually does

Reference count leak on an I2C adapter object: bus_find_device acquires a reference that is never released via put_device in the ACPI reconfiguration path, preventing adapter removal and causing a permanent leak.

Why it matters to the business

Systems may be unable to remove or reconfigure I2C devices, leading to gradual resource exhaustion and operational disruption on servers or embedded platforms that rely on dynamic ACPI-driven I2C topology changes.

How an attack unfolds

An attacker with local privileges triggers repeated ACPI I2C adapter addition/removal operations; each cycle leaks a reference, eventually rendering adapters unremovable and exhausting kernel resources.

How to fix it

Apply the upstream fix that adds put_device after client creation in the ACPI path; upgrade to a kernel containing commit resolving the leak.

How to confirm the fix worked

Inspect kernel source for acpi_i2c_find_adapter_by_handle ensuring a matching put_device call exists after client instantiation; verify running kernel version includes the patch.

Typical attack path

1. Obtain local execution on a Linux system using ACPI I2C devices
2. Trigger repeated device addition and removal via ACPI reconfiguration interfaces
3. Accumulate leaked references until adapters become unremovable
4. Cause denial of service through resource exhaustion or blocked device management

How to detect it

Review kernel logs for repeated i2c adapter addition messages without corresponding removal; monitor reference counts via debugfs or slabinfo for i2c_adapter objects that never decrease.

What your security team should do

• Prioritize kernel updates on all affected Linux distributions
• Monitor for unremovable I2C adapters via sysfs and dmesg
• Restrict unprivileged access to ACPI reconfiguration interfaces where possible