Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2025-21928HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

Description

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed.

Timeline

  1. ID reserved

    By Linux

  2. · 3 months later

    Published

  3. · 14 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-21928, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.24% · top 85% of all CVEs (12 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

  • Linux · Linux

    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < 0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d
    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < d3faae7f42181865c799d88c5054176f38ae4625
    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < 01b18a330cda61cc21423a7d1af92cf31ded8f60
    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394
    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < 560f4d1299342504a6ab8a47f575b5e6b8345ada
    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < dea6a349bcaf243fff95dfd0428a26be6a0fb44e
    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9
    • affected 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 – < 07583a0010696a17fb0942e0b499a62785c5fc9f

  • Linux · Linux

    • affected 4.9
    • unaffected < 4.9
    • unaffected 5.4.291 – ≤ 5.4.*
    • unaffected 5.10.235 – ≤ 5.10.*
    • unaffected 5.15.179 – ≤ 5.15.*
    • unaffected 6.1.131 – ≤ 6.1.*
    • unaffected 6.6.83 – ≤ 6.6.*
    • unaffected 6.12.19 – ≤ 6.12.*
    • unaffected 6.13.7 – ≤ 6.13.*
    • unaffected 6.14 – ≤ *

References

References10

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-21928 badge
[![CVE-2025-21928](https://cveledger.app/badge/CVE-2025-21928.svg)](https://cveledger.app/cve/CVE-2025-21928)

Record last updated .