CVE-2025-21928: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21928 Overview

CVE-2025-21928 is a use-after-free vulnerability [CWE-416] in the Linux kernel's intel-ish-hid HID driver. The flaw resides in the ishtp_hid_remove() function, which frees driver_data inside the loop that destroys HID devices. Because hid_destroy_device() invokes hid_ishtp_set_feature() to power off the sensor, it dereferences driver_data after the memory has already been released. The result is access to freed kernel memory, producing random system crashes minutes after the driver is unloaded. The Linux kernel maintainers resolved the issue by saving driver_data to a temporary variable before the destroy call and freeing it afterward.

Critical Impact
Local attackers with low privileges can trigger kernel memory corruption leading to denial of service or potential privilege escalation on affected Linux systems using Intel Integrated Sensor Hub hardware.

Affected Products

Linux kernel stable branches prior to the fix commits
Linux kernel 6.14-rc1 through 6.14-rc5
Debian LTS distributions shipping the vulnerable intel-ish-hid driver

Discovery Timeline

2025-04-01 - CVE-2025-21928 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21928

Vulnerability Analysis

The defect lives in the Intel Integrated Sensor Hub HID driver (drivers/hid/intel-ish-hid/). When the driver is removed, ishtp_hid_remove() iterates through registered HID devices and frees per-device state. The original code released hid->driver_data before calling hid_destroy_device(), but the destroy path still relies on that pointer to send feature reports that power off the sensor.

The race between memory release and continued dereference produces a classic use-after-free condition. Because the freed memory can be reallocated by another kernel subsystem before hid_destroy_device() completes, the driver ends up reading or writing arbitrary kernel data. This typically manifests as a delayed crash several minutes after rmmod or a hot-unplug event.

Root Cause

The root cause is incorrect object-lifetime management in ishtp_hid_remove(). The function freed driver_data while it was still owned and used by the HID core teardown routine. The patch corrects the ordering by storing the pointer locally, invoking hid_destroy_device() first, then calling kfree() on the saved reference.

Attack Vector

Exploitation requires local access with the ability to trigger driver removal or the associated device teardown path. An attacker who can unload the intel-ish-hid module, or force device removal on a system with an Intel ISH-attached sensor, can reliably induce the use-after-free. The condition affects confidentiality, integrity, and availability of the kernel because freed memory contents may be reused by adjacent allocations.

See the Linux kernel patch commit for the exact source-level fix.

Detection Methods for CVE-2025-21928

Indicators of Compromise

Unexplained kernel oops or panic messages referencing ishtp_hid_remove, hid_destroy_device, or hid_ishtp_set_feature in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free access in the intel-ish-hid driver code path
Delayed system crashes occurring minutes after module unload or device disconnect events

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and staging kernels to surface the use-after-free during QA cycles
Audit installed kernel packages against the fixed versions listed in the vendor advisory commits
Monitor modprobe and rmmod telemetry for intel-ish-hid activity on production endpoints

Monitoring Recommendations

Collect kernel crash dumps centrally and alert on stack traces containing intel-ish-hid symbols
Track auditd events for module load/unload operations targeting HID drivers
Correlate hardware hot-plug events on ISH-enabled platforms with subsequent kernel instability

How to Mitigate CVE-2025-21928

Immediate Actions Required

Apply the Linux kernel security update from your distribution vendor as soon as it becomes available
Debian users should install the updates from the Debian LTS advisory and the follow-up Debian LTS advisory
Restrict local shell and physical access on systems using Intel Integrated Sensor Hub hardware until patched

Patch Information

The fix is committed upstream across multiple stable branches. Reference commits include eb0695d87a81, dea6a349bcaf, d3faae7f4218, cf1a6015d2f6, 560f4d129934, 0c1fb475ef99, 07583a001069, and 01b18a330cda. Rebuild or install a kernel package that incorporates one of these commits, then reboot. See the primary kernel commit reference for source details.

Workarounds

Blocklist the intel-ish-hid module on systems that do not require sensor hub functionality by adding blacklist intel-ish-hid to /etc/modprobe.d/
Avoid unloading the driver at runtime on unpatched kernels; keep it resident until a maintenance reboot into a patched kernel
Limit local user privileges and disable module auto-unload behavior in udev rules for HID sensor devices

bash

# Blocklist the vulnerable driver on systems that do not need it
echo "blacklist intel-ish-hid" | sudo tee /etc/modprobe.d/disable-intel-ish-hid.conf
sudo update-initramfs -u

# Verify installed kernel version against distribution advisory
uname -r
apt list --installed 2>/dev/null | grep linux-image