# CVE-2022-49900: i2c: piix4: Fix adapter not be removed in piix4_remove()

Status: published. Published: 2025-05-01. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

i2c: piix4: Fix adapter not be removed in piix4_remove()

In piix4_probe(), the piix4 adapter will be registered in:

   piix4_probe()
     piix4_add_adapters_sb800() / piix4_add_adapter()
       i2c_add_adapter()

Based on the probed device type, piix4_add_adapters_sb800() or single
piix4_add_adapter() will be called.
For the former case, piix4_adapter_count is set as the number of adapters,
while for antoher case it is not set and kept default *zero*.

When piix4 is removed, piix4_remove() removes the adapters added in
piix4_probe(), basing on the piix4_adapter_count value.
Because the count is zero for the single adapter case, the adapter won't
be removed and makes the sources allocated for adapter leaked, such as
the i2c client and device.

These sources can still be accessed by i2c or bus and cause problems.
An easily reproduced case is that if a new adapter is registered, i2c
will get the leaked adapter and try to call smbus_algorithm, which was
already freed:

Triggered by: rmmod i2c_piix4 && modprobe max31730

 BUG: unable to handle page fault for address: ffffffffc053d860
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 Oops: 0000 [#1] PREEMPT SMP KASAN
 CPU: 0 PID: 3752 Comm: modprobe Tainted: G
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core
 RSP: 0018:ffff888107477710 EFLAGS: 00000246
 ...
 <TASK>
  i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core
  __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core
  bus_for_each_dev (drivers/base/bus.c:301)
  i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core
  i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core
  do_one_initcall (init/main.c:1296)
  do_init_module (kernel/module/main.c:2455)
  ...
 </TASK>
 ---[ end trace 0000000000000000 ]---

Fix this problem by correctly set piix4_adapter_count as 1 for the
single adapter so it can be normally removed.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 528d53a1592b0e27c423f7cafc1df85f77fc1163; < bfd5e62f9a7ee214661cb6f143a3b40ccc63317f (affected, git); ≥ 528d53a1592b0e27c423f7cafc1df85f77fc1163; < d78ccdce662e88f41e87e90cf2bee63c1715d2a5 (affected, git); ≥ 528d53a1592b0e27c423f7cafc1df85f77fc1163; < fe51636fffc8108c7c4da6aa393010e786530ad9 (affected, git); ≥ 528d53a1592b0e27c423f7cafc1df85f77fc1163; < 569bea74c94d37785682b11bab76f557520477cd (affected, git). Source: CNA: Linux
- Linux / Linux: 5.4 (affected); ≥ 0; < 5.4 (unaffected, semver); ≥ 5.10.154; ≤ 5.10.* (unaffected, semver); ≥ 5.15.78; ≤ 5.15.* (unaffected, semver); ≥ 6.0.8; ≤ 6.0.* (unaffected, semver); ≥ 6.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.21% as of 2026-11-05; percentile 11.62%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/bfd5e62f9a7ee214661cb6f143a3b40ccc63317f (CNA: Linux)

- https://git.kernel.org/stable/c/d78ccdce662e88f41e87e90cf2bee63c1715d2a5 (CNA: Linux)

- https://git.kernel.org/stable/c/fe51636fffc8108c7c4da6aa393010e786530ad9 (CNA: Linux)

- https://git.kernel.org/stable/c/569bea74c94d37785682b11bab76f557520477cd (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2022-49900; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2022-49900; retrieved 2026-11-05; source updated Not reported

Revision: bd06098e9f95503e4912796fd1b3e588ee77d725ae8b1aa34fe4334973583e90

Canonical: https://y2.dev/cve/CVE-2022-49900

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.