CVE-2021-47613

What it actually does

The virtio i2c driver incorrectly assumes notify callbacks only occur after all queued buffers complete, allowing premature freeing of buffers while the device may still access them, resulting in use-after-free and memory corruption on the I2C bus or in guest memory.

Why it matters to the business

In virtualized Linux environments using virtio i2c, this can cause system instability, data corruption on connected I2C devices, crashes, or memory corruption that affects guest security and availability; low exploit maturity reduces immediate risk but kernel updates remain important for long-term stability.

How an attack unfolds

An attacker with access to trigger or manipulate virtio notify callbacks (such as via shared interrupts or partial buffer completion) can cause the driver to free buffers early; the device then operates on those freed buffers, leading to corruption or the triggered WARN_ON.

How to fix it

Update the Linux kernel to a version that includes the fix calling virtio_get_buf() from the notify handler and properly waiting for all buffers to complete before freeing.

How to confirm the fix worked

Confirm the kernel source contains the updated notify handler logic that invokes virtio_get_buf() and waits for full buffer completion; test with workloads exercising i2cdev_ioctl_rdwr paths.

Typical attack path

1. Trigger premature or partial notify callback via virtio-pci or shared interrupts
2. Driver frees buffers before device completion
3. Device accesses or writes to already-freed memory
4. Memory corruption or I2C bus data errors occur

How to detect it

Search kernel logs and crash reports for BUG messages involving kmalloc-128 poison overwrites, allocations and frees in i2cdev_ioctl_rdwr, or WARN_ON triggers in the virtio i2c notify path.

• BUG kmalloc-128 (Tainted: G W ): Poison overwritten
• Allocated in i2cdev_ioctl_rdwr
• Freed in i2cdev_ioctl_rdwr
• First byte 0x0 instead of 0x6b

What your security team should do

• Prioritize kernel updates for systems using virtio i2c drivers
• Review virtualization configurations to limit exposure to untrusted virtio devices
• Monitor kernel logs for related use-after-free warnings in i2c paths