CVE-2026-45877: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45877 Overview

CVE-2026-45877 is a NULL pointer dereference vulnerability in the Linux kernel's Intel Integrated Sensor Hub HID driver (intel-ish-hid). The flaw resides in the ishtp_bus_remove_all_clients function within the ISHTP (Integrated Sensor Hub Transport Protocol) bus subsystem. During a warm reset flow, the cl->device pointer may be NULL if the reset occurs while clients are still being enumerated. Accessing cl->device->reference_count without a NULL check triggers a kernel panic. The issue surfaced during multi-unit warm reboot stress cycles and was flagged by KASAN as a null-ptr-deref in range [0000000000000000-0000000000000007].

Critical Impact
Local triggering of warm reset conditions during client enumeration produces a kernel panic, causing a denial-of-service condition on affected Intel platforms using the ISH HID stack.

Affected Products

Linux kernel versions containing the intel-ish-hid driver prior to commits 0b605e8, 272dac5, 56f7db5, and feb4bcf
Intel platforms utilizing the Integrated Sensor Hub (ISH) transport stack
Systems loading the intel_ishtp and intel_ish_ipc kernel modules

Discovery Timeline

2026-05-27 - CVE-2026-45877 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45877

Vulnerability Analysis

The vulnerability lives in the ISHTP bus client teardown path. When the firmware reset workqueue handler fw_reset_work_fn invokes ishtp_reset_handler, that handler calls ishtp_bus_remove_all_clients to iterate over connected ISHTP clients. The iteration dereferences cl->device->reference_count to coordinate removal. If a warm reset arrives before a client's device field is fully populated during enumeration, the dereference targets address 0x0, producing the KASAN report null-ptr-deref in range [0000000000000000-0000000000000007].

The call trace identifies the failure path:

ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp]
ishtp_reset_handler+0x85/0x1a0 [intel_ishtp]
fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc]

The race manifests under sustained warm reboot stress, where firmware reset events overlap with the client probe sequence on the ISHTP bus.

Root Cause

The defect is a missing input validation check on a kernel structure pointer. The ishtp_bus_remove_all_clients routine assumed cl->device was always valid for any client present on the bus list. That assumption breaks when a client has been added to the list but its associated device object has not yet been assigned by the enumeration code path.

Attack Vector

The trigger requires conditions that exercise the firmware reset path during ISH client enumeration, typically reproduced through warm reboot stress on systems with the ISH HID stack loaded. Successful triggering crashes the kernel, denying service. No remote network reachability or arbitrary code execution has been documented for this defect.

The upstream fix introduces a defensive NULL check on cl->device before dereferencing reference_count. See the upstream commits referenced below for the exact patch hunks: Linux Kernel Commit 0b605e8, Linux Kernel Commit 272dac5, Linux Kernel Commit 56f7db5, and Linux Kernel Commit feb4bcf.

Detection Methods for CVE-2026-45877

Indicators of Compromise

Kernel panic logs containing the string KASAN: null-ptr-deref in range [0000000000000000-0000000000000007]
Crash backtrace referencing ishtp_bus_remove_all_clients, ishtp_reset_handler, and fw_reset_work_fn
Workqueue tag ish_fw_update_wq present in the panic context
Repeated unscheduled reboots on Intel systems running the intel_ishtp and intel_ish_ipc modules

Detection Strategies

Inventory running kernel versions across the fleet and flag hosts running intel-ish-hid builds that pre-date the upstream fix commits.
Parse dmesg and /var/log/kern.log for the listed call trace symbols and KASAN signatures.
Correlate firmware reset events from the ish_fw_update_wq workqueue with subsequent host crashes or reboots.

Monitoring Recommendations

Forward kernel ring buffer output to a centralized logging pipeline and alert on null-ptr-deref events tied to intel_ishtp.
Track unexpected reboot frequency on laptops and workstations that load the ISH stack and treat clusters of crashes as a triage signal.
Monitor vendor kernel package channels for backports of the referenced upstream commits and confirm deployment status during patch cycles.

How to Mitigate CVE-2026-45877

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0b605e8, 272dac5, 56f7db5, and feb4bcf or upgrade to a distribution kernel that incorporates these fixes.
Prioritize patching on Intel client systems that exercise warm reset paths, including managed laptops and engineering test fleets.
Validate kernel package versions through configuration management tooling after the rollout.

Patch Information

The fix adds a defensive NULL check for cl->device inside ishtp_bus_remove_all_clients so that the function skips clients whose device pointer has not yet been populated during enumeration. Refer to the upstream stable tree commits for the authoritative diff: Linux Kernel Commit 0b605e8, Linux Kernel Commit 272dac5, Linux Kernel Commit 56f7db5, Linux Kernel Commit feb4bcf.

Workarounds

On systems where the ISH HID functionality is unused, blacklist the intel_ishtp and intel_ish_ipc modules to remove the vulnerable code path.
Avoid running warm reboot stress workloads on unpatched hosts until the kernel update is deployed.
Where module removal is not viable, schedule firmware update and reset operations during maintenance windows and minimize concurrent client enumeration activity.

bash

# Blacklist the affected modules where ISH HID is not required
echo 'blacklist intel_ishtp' | sudo tee /etc/modprobe.d/blacklist-intel-ish.conf
echo 'blacklist intel_ish_ipc' | sudo tee -a /etc/modprobe.d/blacklist-intel-ish.conf
sudo update-initramfs -u

# Verify the running kernel after patching
uname -r
dmesg | grep -i ishtp