CVE-2025-21928

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21928
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21928.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21928
Downstream
Related
Published
2025-04-01T15:40:59.033Z
Modified
2026-03-11T07:51:01.465014Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
Details

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-ish-hid: Fix use-after-free issue in ishtphidremove()

The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtphidremove() function.

The function currently frees the driver_data directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, hid_destroy_device() uses driver_data when it calls hid_ishtp_set_feature() to power off the sensor, so freeing driver_data beforehand can result in accessing invalid memory.

This patch resolves the issue by storing the driver_data in a temporary variable before calling hid_destroy_device(), and then freeing the driver_data after the device is destroyed.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21928.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6
Fixed
0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d
Fixed
d3faae7f42181865c799d88c5054176f38ae4625
Fixed
01b18a330cda61cc21423a7d1af92cf31ded8f60
Fixed
cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394
Fixed
560f4d1299342504a6ab8a47f575b5e6b8345ada
Fixed
dea6a349bcaf243fff95dfd0428a26be6a0fb44e
Fixed
eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9
Fixed
07583a0010696a17fb0942e0b499a62785c5fc9f

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21928.json"