In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: Fix use-after-free issue in ishtphidremove()
The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtphidremove() function.
The function currently frees the driver_data directly within the loop
that destroys the HID devices, which can lead to accessing freed memory.
Specifically, hid_destroy_device() uses driver_data when it calls
hid_ishtp_set_feature() to power off the sensor, so freeing
driver_data beforehand can result in accessing invalid memory.
This patch resolves the issue by storing the driver_data in a temporary
variable before calling hid_destroy_device(), and then freeing the
driver_data after the device is destroyed.
[
    {
        "id": "CVE-2025-21928-1fc49883",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b18a330cda61cc21423a7d1af92cf31ded8f60"
    },
    {
        "id": "CVE-2025-21928-34dde8eb",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dea6a349bcaf243fff95dfd0428a26be6a0fb44e"
    },
    {
        "id": "CVE-2025-21928-3e1c25ea",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394"
    },
    {
        "id": "CVE-2025-21928-54faec9e",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b18a330cda61cc21423a7d1af92cf31ded8f60"
    },
    {
        "id": "CVE-2025-21928-568d456a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@560f4d1299342504a6ab8a47f575b5e6b8345ada"
    },
    {
        "id": "CVE-2025-21928-5a2d4288",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394"
    },
    {
        "id": "CVE-2025-21928-60237d51",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07583a0010696a17fb0942e0b499a62785c5fc9f"
    },
    {
        "id": "CVE-2025-21928-8029562b",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07583a0010696a17fb0942e0b499a62785c5fc9f"
    },
    {
        "id": "CVE-2025-21928-967fb555",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d"
    },
    {
        "id": "CVE-2025-21928-9a980204",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dea6a349bcaf243fff95dfd0428a26be6a0fb44e"
    },
    {
        "id": "CVE-2025-21928-b809676d",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9"
    },
    {
        "id": "CVE-2025-21928-d8e8c140",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d"
    },
    {
        "id": "CVE-2025-21928-e385e4f9",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@560f4d1299342504a6ab8a47f575b5e6b8345ada"
    },
    {
        "id": "CVE-2025-21928-f3d997a8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9"
    },
    {
        "id": "CVE-2025-21928-fa492fc2",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
        },
        "digest": {
            "line_hashes": [
                "322358703963478980729766542969684922682",
                "4461031346696136446652393411298010177",
                "52111984635166003055207713972353070775",
                "251938100073053910765015418169184570685",
                "157271000435985006865568954183008344772",
                "157006484075886458120300186193887669789",
                "272547764191453870529993603687181584695",
                "264819235111408337220326878791761692583",
                "75564849274787328189004410915519304610"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3faae7f42181865c799d88c5054176f38ae4625"
    },
    {
        "id": "CVE-2025-21928-faad4a51",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
            "function": "ishtp_hid_remove"
        },
        "digest": {
            "function_hash": "11462485950505617393173316153648425597",
            "length": 307.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3faae7f42181865c799d88c5054176f38ae4625"
    }
]