7.8

CVE-2025-21928: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

Modified
AliasesUBUNTU-CVE-2025-21928DEBIAN-CVE-2025-21928
Published 01-04-2025Last modified 11-05-2026

Vulnerability summary

CVE-2025-21928 is a high (CVSS 7.8) Use After Free vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 77 · Related 59
DLA-4178-1DLA-4193-1DSA-5900-1RHSA-2025:12662RHSA-2025:12746RHSA-2025:12752

Timeline

  1. 01-04-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.23% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu136 products
  • linuxAll versions (No fix recorded) | < 5.4.0-216.236 | < 5.15.0-140.150 | < 6.8.0-84.84
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1146.156 | < 5.15.0-1084.91 | < 6.8.0-1039.41
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < 0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d | ≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < d3faae7f42181865c799d88c5054176f38ae4625 | ≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < 01b18a330cda61cc21423a7d1af92cf31ded8f60 | ≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394 | ≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < 560f4d1299342504a6ab8a47f575b5e6b8345ada | ≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < dea6a349bcaf243fff95dfd0428a26be6a0fb44e | ≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9 | ≥ 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6, < 07583a0010696a17fb0942e0b499a62785c5fc9f | 4.9
  • linux_kernel≥ 4.9, < 5.4.291 | ≥ 5.5, < 5.10.235 | ≥ 5.11, < 5.15.179 | ≥ 5.16, < 6.1.131 | ≥ 6.2, < 6.6.83 | ≥ 6.7, < 6.12.19 | ≥ 6.13, < 6.13.7 | 6.14:rc1 | 6.14:rc2 | 6.14:rc3 | 6.14:rc4 | 6.14:rc5
Debian1 product
  • linux< 6.1.133-1 | < 6.12.19-1

3 vendors · 139 products

References

62 links
Show all 62 references