CVE-2025-21928

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21928
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21928.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21928
Downstream
Related
Published
2025-04-01T15:40:59.033Z
Modified
2026-05-18T05:57:24.461254103Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
Details

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-ish-hid: Fix use-after-free issue in ishtphidremove()

The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtphidremove() function.

The function currently frees the driver_data directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, hid_destroy_device() uses driver_data when it calls hid_ishtp_set_feature() to power off the sensor, so freeing driver_data beforehand can result in accessing invalid memory.

This patch resolves the issue by storing the driver_data in a temporary variable before calling hid_destroy_device(), and then freeing the driver_data after the device is destroyed.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21928.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6
Fixed
0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d
Fixed
d3faae7f42181865c799d88c5054176f38ae4625
Fixed
01b18a330cda61cc21423a7d1af92cf31ded8f60
Fixed
cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394
Fixed
560f4d1299342504a6ab8a47f575b5e6b8345ada
Fixed
dea6a349bcaf243fff95dfd0428a26be6a0fb44e
Fixed
eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9
Fixed
07583a0010696a17fb0942e0b499a62785c5fc9f

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21928.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.9.0
Fixed
5.4.291
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.235
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.179
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.131
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.83
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.19
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21928.json"