# CVE-2021-47613: linux: In the Linux kernel, the following vulnerability has been resolved:  i2c: virtio: fix completion handling  The driver...

CVE-2021-47613 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47613, released June 19, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-47613
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 19, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  i2c: virtio: fix completion handling  The driver currently assumes that the notify callback is only received when the device is done with all the queued buffers.  However, this is not true, since the notify callback could be called without any of the queued buffers being completed (for example, with virtio-pci and shared interrupts) or with only some of the buffers being completed (since the driver makes them available to the device in multiple separate virtqueue_add_sgs() calls).  This can lead to incorrect data on the I2C bus or memory corruption in the guest if the device operates on buffers which are have been freed by the driver.  (The WARN_ON in the driver is also triggered.)   BUG kmalloc-128 (Tainted: G        W        ): Poison overwritten  First byte 0x0 instead of 0x6b  Allocated in i2cdev_ioctl_rdwr+0x9d/0x1de age=243 cpu=0 pid=28  	memdup_user+0x2e/0xbd  	i2cdev_ioctl_rdwr+0x9d/0x1de  	i2cdev_ioctl+0x247/0x2ed  	vfs_ioctl+0x21/0x30  	sys_ioctl+0xb18/0xb41  Freed in i2cdev_ioctl_rdwr+0x1bb/0x1de age=68 cpu=0 pid=28  	kfree+0x1bd/0x1cc  	i2cdev_ioctl_rdwr+0x1bb/0x1de  	i2cdev_ioctl+0x247/0x2ed  	vfs_ioctl+0x21/0x30  	sys_ioctl+0xb18/0xb41  Fix this by calling virtio_get_buf() from the notify handler like other virtio drivers and by actually waiting for all the buffers to be completed.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.15.15-1 | [DEBIAN-CVE-2021-47613](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47613.md) | Jun 19, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.15.15-1 | [DEBIAN-CVE-2021-47613](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47613.md) | Jun 19, 2024 |
| Linux | linux Debian 14 | 5.15.15-1 | [DEBIAN-CVE-2021-47613](https://patchblox.com/security/data/fix/linux/debian-cve-2021-47613.md) | Jun 19, 2024 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.