{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39711", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.116Z", "datePublished": "2025-09-05T17:21:18.348Z", "dateUpdated": "2026-08-05T12:04:46.297Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:04:46.297Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls\n\nBoth the ACE and CSI driver are missing a mei_cldev_disable() call in\ntheir remove() function.\n\nThis causes the mei_cl client to stay part of the mei_device->file_list\nlist even though its memory is freed by mei_cl_bus_dev_release() calling\nkfree(cldev->cl).\n\nThis leads to a use-after-free when mei_vsc_remove() runs mei_stop()\nwhich first removes all mei bus devices calling mei_ace_remove() and\nmei_csi_remove() followed by mei_cl_bus_dev_release() and then calls\nmei_cl_all_disconnect() which walks over mei_device->file_list dereferecing\nthe just freed cldev->cl.\n\nAnd mei_vsc_remove() it self is run at shutdown because of the\nplatform_device_unregister(tp->pdev) in vsc_tp_shutdown()\n\nWhen building a kernel with KASAN this leads to the following KASAN report:\n\n[ 106.634504] ==================================================================\n[ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei\n[ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1\n[ 106.634729]\n[ 106.634767] Tainted: [E]=UNSIGNED_MODULE\n[ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025\n[ 106.634773] Call Trace:\n[ 106.634777] \n...\n[ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636)\n[ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei\n[ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei\n[ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei\n...\n[ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei\n[ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc\n[ 106.635066] platform_remove (drivers/base/platform.c:1424)\n\nAdd the missing mei_cldev_disable() calls so that the mei_cl gets removed\nfrom mei_device->file_list before it is freed to fix this." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is an SPI/MEI-attached Intel Visual Sensing Controller driver teardown path reached only from local device-model events (system shutdown, module unload, driver unbind); there is no network-facing component.\nAC:L - The use-after-free is fully deterministic — the mei_cl is unconditionally left on file_list after being kfree'd, so every mei_vsc teardown hits it — and the attacker both initiates the teardown and controls concurrent heap allocations during the multi-millisecond window between the kfree and the mei_cl_all_disconnect() walk.\nPR:L - Any unprivileged user with a local session on the affected laptops can trigger the path by requesting a shutdown/reboot, which logind/polkit permits without authentication by default (the KASAN trace's offending task is the systemd shutdown path). No root or capability is needed to reach the teardown.\nUI:N - The attacker initiates the shutdown/unbind themselves and the freed object is dereferenced automatically in the same code path; no action by a separate victim is required.\nS:U - The corruption and its consequences are confined to kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed struct mei_cl is read back (state, dev, me_cl, four wait_queue_heads) and the list traversal follows a dangling next pointer, so heap grooming of the reclaimed general-purpose slab object yields kernel memory disclosure primitives.\nI:H - The path writes into freed memory (cl->state assignment, list_del operations on freed list heads), does a kref_put through a freed me_cl pointer, and calls wake_up() on four freed wait queues — an indirect call through an attacker-controlled function pointer, i.e. a control-flow hijack primitive.\nA:H - Confirmed KASAN slab-use-after-free with a kernel oops on the shutdown path, reproducible on every reboot of affected hardware and readily escalated to a full panic via corrupted list traversal." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/pci/intel/ivsc/mei_ace.c", "drivers/media/pci/intel/ivsc/mei_csi.c" ], "versions": [ { "version": "29006e196a5661d9afc8152fa2bf8a5347ac17b4", "lessThan": "3c0e4cc4f55f9a1db2a761e4ffb27c9594245888", "status": "affected", "versionType": "git" }, { "version": "29006e196a5661d9afc8152fa2bf8a5347ac17b4", "lessThan": "639f5b33fcd7c59157f29b09f6f2866eacf9279c", "status": "affected", "versionType": "git" }, { "version": "29006e196a5661d9afc8152fa2bf8a5347ac17b4", "lessThan": "1dfe73394dcfc9b049c8da0dc181c45f156a5f49", "status": "affected", "versionType": "git" }, { "version": "29006e196a5661d9afc8152fa2bf8a5347ac17b4", "lessThan": "0c92c49fc688cfadacc47ae99b06a31237702e9e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/pci/intel/ivsc/mei_ace.c", "drivers/media/pci/intel/ivsc/mei_csi.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.16.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3c0e4cc4f55f9a1db2a761e4ffb27c9594245888" }, { "url": "https://git.kernel.org/stable/c/639f5b33fcd7c59157f29b09f6f2866eacf9279c" }, { "url": "https://git.kernel.org/stable/c/1dfe73394dcfc9b049c8da0dc181c45f156a5f49" }, { "url": "https://git.kernel.org/stable/c/0c92c49fc688cfadacc47ae99b06a31237702e9e" } ], "title": "media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls", "x_generator": { "engine": "bippy-1.2.0" } } } }