Executive brief
A vulnerability in the Linux kernel's Intel Integrated Sensor Hub (ISH) driver can cause a system crash (kernel panic) during a warm reset. This occurs when the system attempts to clean up internal device connections before they are fully initialized. While this primarily affects system stability during reboots or firmware updates, it could be used to cause a denial-of-service on affected hardware.
Technical details
A NULL pointer dereference vulnerability exists in the 'ishtp_bus_remove_all_clients' function within the Intel Integrated Sensor Hub (ISH) Transport layer (intel-ish-hid). During a warm reset, if the reset occurs while clients are still being enumerated, the 'cl->device' pointer may be NULL. The code fails to validate this pointer before accessing 'cl->device->reference_count', resulting in a kernel panic. This issue was identified via KASAN during warm reboot stress testing. Patches have been released to add a defensive NULL check in 'drivers/hid/intel-ish-hid/ishtp/bus.c'.
Affected products
- Linux Linux kernel All versions prior to the fix in 2026
Timeline
- 2026-05-27: advisory: NVD publication date
- 2026-02-02: patched: Initial fix committed to the Linux kernel tree