CVE-2025-21928: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed.

Affected products

• Linux Linux Kernel: from 4.9, before 5.4.291 (fixed in 5.4.291); from 5.5, before 5.10.235 (fixed in 5.10.235); from 5.11, before 5.15.179 (fixed in 5.15.179); from 5.16, before 6.1.131 (fixed in 6.1.131); from 6.2, before 6.6.83 (fixed in 6.6.83); from 6.7, before 6.12.19 (fixed in 6.12.19); …

Published 2025-04-01. Last modified 2026-06-17.