In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 5, 2025 | May 2, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools | Oct 14, 2025 | Sep 15, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade bpftool | Nov 12, 2025 | Sep 15, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Sep 25, 2025 | Sep 15, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 2, 2025 |
| Ubuntu | — | Upgrade linux-gkeUpgrade linux-intel-iotgUpgrade linux-oracleUpgrade linux-riscv-5.15Upgrade linux-nvidiaUpgrade linux-ibm-5.15Upgrade linux-lowlatencyUpgrade linux-intel-iotg-5.15Upgrade linux-aws-5.15Upgrade linux-gcp-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-ibmUpgrade linux-raspiUpgrade linux-kvmUpgrade linux-azureUpgrade linux-hwe-5.15Upgrade linuxUpgrade linux-gkeopUpgrade linux-nvidia-tegraUpgrade linux-oracle-5.15Upgrade linux-azure-5.15Upgrade linux-realtimeUpgrade linux-bluefieldUpgrade linux-nvidia-tegra-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gcpUpgrade linux-intel-iot-realtimeUpgrade linux-awsUpgrade linux-lowlatency-hwe-5.15 | May 8, 2025 | May 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub