CVE-2025-21928

HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

State: Published
Severity: 7.8 High
Published: Apr 1, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function.

The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory.

This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03dAffected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before d3faae7f42181865c799d88c5054176f38ae4625Affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 01b18a330cda61cc21423a7d1af92cf31ded8f60Affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394Affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 560f4d1299342504a6ab8a47f575b5e6b8345adaAffected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before dea6a349bcaf243fff95dfd0428a26be6a0fb44eAffected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9Affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 07583a0010696a17fb0942e0b499a62785c5fc9fAffected
LinuxLinux	4.9Affected before 4.9Not affected 5.4.291 through 5.4.Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.131 through 6.1.Not affected 6.6.83 through 6.6.Not affected 6.12.19 through 6.12.Not affected 6.13.7 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03dAffected
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before d3faae7f42181865c799d88c5054176f38ae4625Affected
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 01b18a330cda61cc21423a7d1af92cf31ded8f60Affected
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394Affected
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 560f4d1299342504a6ab8a47f575b5e6b8345adaAffected
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before dea6a349bcaf243fff95dfd0428a26be6a0fb44eAffected
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9Affected
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 to before 07583a0010696a17fb0942e0b499a62785c5fc9fAffected

LinuxLinux

4.9Affected
before 4.9Not affected
5.4.291 through 5.4.*Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.131 through 6.1.*Not affected
6.6.83 through 6.6.*Not affected
6.12.19 through 6.12.*Not affected
6.13.7 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.