In the Linux kernel, the following vulnerability has been resolved:
media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function.
This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling kfree(cldev->cl).
This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing the just freed cldev->cl.
And mei_vsc_remove() it self is run at shutdown because of the platform_device_unregister(tp->pdev) in vsc_tp_shutdown()
When building a kernel with KASAN this leads to the following KASAN report:
[ 106.634504] ================================================================== [ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1 [ 106.634729] [ 106.634767] Tainted: [E]=UNSIGNED_MODULE [ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025 [ 106.634773] Call Trace: [ 106.634777] <TASK> ... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [ 106.635066] platform_remove (drivers/base/platform.c:1424)
Add the missing mei_cldev_disable() calls so that the mei_cl gets removed from mei_device->file_list before it is freed to fix this.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade dtb-apmUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade dtb-freescaleUpgrade kernel-kvmsmallUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-default-baseUpgrade kernel-zfcpdumpUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-rt-extraUpgrade dtb-socionextUpgrade kernel-defaultUpgrade kernel-obs-qaUpgrade kernel-rtUpgrade dtb-amazonUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade dtb-amlogicUpgrade kernel-kvmsmall-vdsoUpgrade kernel-syms-azureUpgrade ocfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade kernel-docsUpgrade gfs2-kmp-rtUpgrade kernel-64kbUpgrade kselftests-kmp-rtUpgrade dtb-appleUpgrade kernel-devel-azureUpgrade dtb-nvidiaUpgrade dtb-alteraUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-symsUpgrade kernel-rt-livepatchUpgrade kernel-azureUpgrade dtb-qcomUpgrade dtb-rockchipUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-default-optionalUpgrade kernel-rt-develUpgrade kernel-64kb-develUpgrade dtb-hisiliconUpgrade dtb-armUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade dtb-exynosUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade kernel-develUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-default-vdsoUpgrade dtb-caviumUpgrade kernel-default-livepatch-develUpgrade kernel-source-vanillaUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-default | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-ibm-6.8Upgrade linux-image-raspiUpgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-generic-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04cUpgrade linux-image-oracle-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-gke-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-xilinxUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-azure-fipsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-ibm-classicUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-gcpUpgrade linux-image-aws-6.8Upgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-gkeopUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-azure-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-xilinx-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-aws-fipsUpgrade linux-image-raspi-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-realtimeUpgrade linux-image-fipsUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1030-gkeop | Feb 12, 2026 | Sep 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub