CVE-2025-21929

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()

During the `rmmod` operation for the `intel_ishtp_hid` driver, a

use-after-free issue can occur in the hid_ishtp_cl_remove() function.

The function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(),

which can lead to accessing freed memory or resources during the

removal process.

Call Trace:

? ishtp_cl_send+0x168/0x220 [intel_ishtp]

? hid_output_report+0xe3/0x150 [hid]

hid_ishtp_set_feature+0xb5/0x120 [intel_ishtp_hid]

ishtp_hid_request+0x7b/0xb0 [intel_ishtp_hid]

hid_hw_request+0x1f/0x40 [hid]

sensor_hub_set_feature+0x11f/0x190 [hid_sensor_hub]

_hid_sensor_power_state+0x147/0x1e0 [hid_sensor_trigger]

hid_sensor_runtime_resume+0x22/0x30 [hid_sensor_trigger]

sensor_hub_remove+0xa8/0xe0 [hid_sensor_hub]

hid_device_remove+0x49/0xb0 [hid]

hid_destroy_device+0x6f/0x90 [hid]

ishtp_hid_remove+0x42/0x70 [intel_ishtp_hid]

hid_ishtp_cl_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References