PT-2025-14309 · Linux+11 · Linux Kernel+11
Published
2025-04-01
·
Updated
2026-04-20
·
CVE-2025-21928
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free issue in the
ishtp hid remove() function can cause the system to experience a random crash a few minutes after the driver is removed. This occurs due to improper handling of memory freeing, where the driver data is freed directly within the loop that destroys the HID devices, leading to accessing freed memory. Specifically, hid destroy device() uses driver data when it calls hid ishtp set feature() to power off the sensor, so freeing driver data beforehand can result in accessing invalid memory.Recommendations
To resolve the issue, store the
driver data in a temporary variable before calling hid destroy device(), and then free the driver data after the device is destroyed. As a temporary workaround, consider disabling the ishtp hid remove() function until a patch is available. Restrict access to the hid destroy device() function to minimize the risk of exploitation. Avoid using the driver data variable in the affected ishtp hid remove() function until the issue is resolved.Exploit
Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu