CVE-2025-21928 Information

Apr 03, 2025 cve

Description

In the Linux kernel the following vulnerability has been resolved:

HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function.

The function currently frees the driver_data directly within the loop that destroys the HID devices which can lead to accessing freed memory. Specifically hid_destroy_device() uses driver_data when it calls hid_ishtp_set_feature() to power off the sensor so freeing driver_data beforehand can result in accessing invalid memory.

This patch resolves the issue by storing the driver_data in a temporary variable before calling hid_destroy_device() and then freeing the driver_data after the device is destroyed.

Reference

Share on: