In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: Fix use-after-free issue in ishtphidremove()
The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtphidremove() function.
The function currently frees the driver_data directly within the loop
that destroys the HID devices, which can lead to accessing freed memory.
Specifically, hid_destroy_device() uses driver_data when it calls
hid_ishtp_set_feature() to power off the sensor, so freeing
driver_data beforehand can result in accessing invalid memory.
This patch resolves the issue by storing the driver_data in a temporary
variable before calling hid_destroy_device(), and then freeing the
driver_data after the device is destroyed.
[
{
"id": "CVE-2025-21928-1fc49883",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b18a330cda61cc21423a7d1af92cf31ded8f60"
},
{
"id": "CVE-2025-21928-34dde8eb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dea6a349bcaf243fff95dfd0428a26be6a0fb44e"
},
{
"id": "CVE-2025-21928-3e1c25ea",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394"
},
{
"id": "CVE-2025-21928-54faec9e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b18a330cda61cc21423a7d1af92cf31ded8f60"
},
{
"id": "CVE-2025-21928-568d456a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@560f4d1299342504a6ab8a47f575b5e6b8345ada"
},
{
"id": "CVE-2025-21928-5a2d4288",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394"
},
{
"id": "CVE-2025-21928-60237d51",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07583a0010696a17fb0942e0b499a62785c5fc9f"
},
{
"id": "CVE-2025-21928-8029562b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07583a0010696a17fb0942e0b499a62785c5fc9f"
},
{
"id": "CVE-2025-21928-967fb555",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d"
},
{
"id": "CVE-2025-21928-9a980204",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dea6a349bcaf243fff95dfd0428a26be6a0fb44e"
},
{
"id": "CVE-2025-21928-b809676d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9"
},
{
"id": "CVE-2025-21928-d8e8c140",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d"
},
{
"id": "CVE-2025-21928-e385e4f9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@560f4d1299342504a6ab8a47f575b5e6b8345ada"
},
{
"id": "CVE-2025-21928-f3d997a8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9"
},
{
"id": "CVE-2025-21928-fa492fc2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c"
},
"digest": {
"line_hashes": [
"322358703963478980729766542969684922682",
"4461031346696136446652393411298010177",
"52111984635166003055207713972353070775",
"251938100073053910765015418169184570685",
"157271000435985006865568954183008344772",
"157006484075886458120300186193887669789",
"272547764191453870529993603687181584695",
"264819235111408337220326878791761692583",
"75564849274787328189004410915519304610"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3faae7f42181865c799d88c5054176f38ae4625"
},
{
"id": "CVE-2025-21928-faad4a51",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/hid/intel-ish-hid/ishtp-hid.c",
"function": "ishtp_hid_remove"
},
"digest": {
"function_hash": "11462485950505617393173316153648425597",
"length": 307.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3faae7f42181865c799d88c5054176f38ae4625"
}
]