CVE-2025-39711

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls

Both the ACE and CSI driver are missing a mei_cldev_disable() call in

their remove() function.

This causes the mei_cl client to stay part of the mei_device->file_list

list even though its memory is freed by mei_cl_bus_dev_release() calling

kfree(cldev->cl).

This leads to a use-after-free when mei_vsc_remove() runs mei_stop()

which first removes all mei bus devices calling mei_ace_remove() and

mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls

mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing

the just freed cldev->cl.

And mei_vsc_remove() it self is run at shutdown because of the

platform_device_unregister(tp->pdev) in vsc_tp_shutdown()

When building a kernel with KASAN this leads to the following KASAN report:

[ 106.634504] ==================================================================

[ 10

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References