The Linux kernel's HID driver for the MCP2221 device had a flaw where the caller-supplied buffer pointer (mcp->rxbuf) was retained after an I2C/SMBus transfer finished or timed out. This dangling pointer could be triggered by delayed or spurious MCP2221_I2C_GET_DATA reports, causing the mcp2221_raw_event() function to memcpy device data into freed memory, leading to a write use-after-free vulnerability. The fix routes all return paths through a single exit point that clears mcp->rxbuf and mcp->rxbuf_size, preventing the use of stale pointers.

This vulnerability can lead to memory corruption in the kernel due to a write use-after-free condition. Such corruption could potentially be exploited to cause system instability or escalate privileges, although no exploits in the wild are currently known.

A fix has been implemented in the Linux kernel to clear the rxbuf pointer after I2C/SMBus transfers complete or time out, preventing the use-after-free condition. Users should update their Linux kernel to a version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel advisory for the exact fixed version and remediation guidance.