CVE-2025-21929: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: Fix use-after-free issue in hidishtpclremove()
During the rmmod operation for the intelishtphid driver, a use-after-free issue can occur in the hidishtpclremove() function. The function hidishtpcldeinit() is called before ishtphidremove(), which can lead to accessing freed memory or resources during the removal process.
Call Trace: ? ishtpclsend+0x168/0x220 [intelishtp] ? hidoutputreport+0xe3/0x150 [hid] hidishtpsetfeature+0xb5/0x120 [intelishtphid] ishtphidrequest+0x7b/0xb0 [intelishtphid] hidhwrequest+0x1f/0x40 [hid] sensorhubsetfeature+0x11f/0x190 [hidsensorhub] hidsensorpowerstate+0x147/0x1e0 [hidsensortrigger] hidsensorruntimeresume+0x22/0x30 [hidsensortrigger] sensorhubremove+0xa8/0xe0 [hidsensorhub] hiddeviceremove+0x49/0xb0 [hid] hiddestroydevice+0x6f/0x90 [hid] ishtphidremove+0x42/0x70 [intelishtphid] hidishtpclremove+0x6b/0xb0 [intelishtphid] ishtpcldeviceremove+0x4a/0x60 [intelishtp] ...
Additionally, ishtphidremove() is a HID level power off, which should occur before the ISHTP level disconnect.
This patch resolves the issue by reordering the calls in hidishtpclremove(). The function ishtphidremove() is now called before hidishtpcldeinit().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
During the `rmmod`/driver removal process for `intel_ishtp_hid`, avoid triggering the HID power-off/removal path until the kernel fix that reorders calls is applied, to prevent the reported use-after-free in `hid_ishtp_cl_remove()`.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21929?
CVE-2025-21929 has been classified as a high severity vulnerability in the Linux kernel due to its use-after-free issue.
How do I fix CVE-2025-21929?
To resolve CVE-2025-21929, users should update to the latest patched version of the Linux kernel as provided by their distribution.
What are the potential impacts of CVE-2025-21929?
CVE-2025-21929 can lead to system instability or potential exploitation through privilege escalation during the rmmod operation.
Which software versions are affected by CVE-2025-21929?
CVE-2025-21929 affects the Linux kernel, specifically versions prior to the implementation of the fix for this vulnerability.
How can I check if my system is vulnerable to CVE-2025-21929?
To check for vulnerability to CVE-2025-21929, verify your Linux kernel version and consult your distribution's security advisories.