In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()
During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in the hid_ishtp_cl_remove() function. The function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(), which can lead to accessing freed memory or resources during the removal process.
Call Trace: ? ishtp_cl_send+0x168/0x220 [intel_ishtp] ? hid_output_report+0xe3/0x150 [hid] hid_ishtp_set_feature+0xb5/0x120 [intel_ishtp_hid] ishtp_hid_request+0x7b/0xb0 [intel_ishtp_hid] hid_hw_request+0x1f/0x40 [hid] sensor_hub_set_feature+0x11f/0x190 [hid_sensor_hub] _hid_sensor_power_state+0x147/0x1e0 [hid_sensor_trigger] hid_sensor_runtime_resume+0x22/0x30 [hid_sensor_trigger] sensor_hub_remove+0xa8/0xe0 [hid_sensor_hub] hid_device_remove+0x49/0xb0 [hid] hid_destroy_device+0x6f/0x90 [hid] ishtp_hid_remove+0x42/0x70 [intel_ishtp_hid] hid_ishtp_cl_remove+0x6b/0xb0 [intel_ishtp_hid] ishtp_cl_device_remove+0x4a/0x60 [intel_ishtp] ...
Additionally, ishtp_hid_remove() is a HID level power off, which should occur before the ISHTP level disconnect.
This patch resolves the issue by reordering the calls in hid_ishtp_cl_remove(). The function ishtp_hid_remove() is now called before hid_ishtp_cl_deinit().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64kUpgrade kernel-toolsUpgrade kernel-rt-64k-debug-coreUpgrade kernel-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade perfUpgrade kernel-modules-coreUpgrade kernel-abi-stablelistsUpgrade rvUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-debugUpgrade kernel-rt-64k-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-cross-headersUpgrade libperfUpgrade kernel-uki-virt-addonsUpgrade kernelUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-rt-debug-kvmUpgrade kernel-64k-modulesUpgrade kernel-debug-coreUpgrade kernel-64kUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-kvmUpgrade rtlaUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-develUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-coreUpgrade kernel-uki-virtUpgrade kernel-tools-libsUpgrade kernel-rt-64k-coreUpgrade kernel-debugUpgrade kernel-64k-develUpgrade kernel-docUpgrade kernel-64k-modules-coreUpgrade kernel-rt-debug-modules-extra | Aug 8, 2025 | Aug 4, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel | Aug 12, 2025 | Apr 1, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 9, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-develUpgrade kernel-debug-develUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernelUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-coreUpgrade kernel-debug-modules-coreUpgrade kernel-develUpgrade kernel-rt-debugUpgrade rtlaUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-coreUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade rvUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade perf-debuginfoUpgrade libperfUpgrade perfUpgrade kernel-tools-libs-develUpgrade kernel-headersUpgrade kernel-rt-debug-develUpgrade kernel-rtUpgrade kernel-zfcpdump-modules | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade kernel-symsUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-64kbUpgrade kernel-source-vanillaUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-azureUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-docsUpgrade kernel-64kb-extraUpgrade kernel-obs-qaUpgrade kernel-obs-buildUpgrade kernel-64kb-develUpgrade kernel-default-base | Dec 5, 2025 | Aug 6, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-22.04aUpgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-raspi-6.8Upgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-aws-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-6.8.0-85-genericUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-6.8.0-1036-azureUpgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtual-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-aws-64kUpgrade linux-image-raspiUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-6.8.0-1039-awsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-ibm-classicUpgrade linux-image-azure-fdeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-azure-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-azure-fde-edgeUpgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oracle-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-azure-nvidiaUpgrade linux-image-aws-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-azureUpgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-kvmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-6.8.0-84-genericUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-azure-6.11Upgrade linux-image-oracleUpgrade linux-image-virtualUpgrade linux-image-ibm-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-lowlatency-6.11Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-generic-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-azure-fde-6.11Upgrade linux-image-gkeUpgrade linux-image-generic-lpae | Jun 26, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub