CVE-2026-45877 - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients

Back Back to CVE browser

MEDIUM

HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients

Published May 27, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.16%

Description

During a warm reset flow, the cl->device pointer may be NULL if the reset occurs while clients are still being enumerated. Accessing cl->device->reference_count without a NULL check leads to a kernel panic.

This issue was identified during multi-unit warm reboot stress clycles. Add a defensive NULL check for cl->device to ensure stability under such intensive testing conditions.

KASAN: null-ptr-deref in range [0000000000000000-0000000000000007] Workqueue: ish_fw_update_wq fw_reset_work_fn

Call Trace: ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp] ishtp_reset_handler+0x85/0x1a0 [intel_ishtp] fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc]

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  4.9
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.9
- Version
  6.12.75
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.14
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.19.4
  Status
  unaffected
  Constraints
  <=6.19.*
- Version
  7.0
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
4.9	affected	-
0	unaffected	<4.9
6.12.75	unaffected	<=6.12.*
6.18.14	unaffected	<=6.18.*
6.19.4	unaffected	<=6.19.*
7.0	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Fix deferred
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Fix deferred
Red Hat Enterprise Linux 7

kernel-rt

Fix deferred
Red Hat Enterprise Linux 8

kernel

Fix deferred
Red Hat Enterprise Linux 8

kernel-rt

Fix deferred
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 7	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 8	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 8	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (9)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-45877		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2482144		Issue Tracking
https://git.kernel.org/stable/c/0b605e8ce60698c27a26f512968a597fd620d2e8		Patch
https://git.kernel.org/stable/c/272dac57caa981718e7188c80c703e7bb1998054		Patch
https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58		Patch
https://git.kernel.org/stable/c/feb4bcfd405282de60aba321f13a1272b30c5af4		Patch
https://lore.kernel.org/linux-cve-announce/2026052714-CVE-2026-45877-f416@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45877
https://www.cve.org/CVERecord?id=CVE-2026-45877