{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39711","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.116Z","datePublished":"2025-09-05T17:21:18.348Z","dateUpdated":"2026-08-05T12:04:46.297Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:04:46.297Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls\n\nBoth the ACE and CSI driver are missing a mei_cldev_disable() call in\ntheir remove() function.\n\nThis causes the mei_cl client to stay part of the mei_device->file_list\nlist even though its memory is freed by mei_cl_bus_dev_release() calling\nkfree(cldev->cl).\n\nThis leads to a use-after-free when mei_vsc_remove() runs mei_stop()\nwhich first removes all mei bus devices calling mei_ace_remove() and\nmei_csi_remove() followed by mei_cl_bus_dev_release() and then calls\nmei_cl_all_disconnect() which walks over mei_device->file_list dereferecing\nthe just freed cldev->cl.\n\nAnd mei_vsc_remove() it self is run at shutdown because of the\nplatform_device_unregister(tp->pdev) in vsc_tp_shutdown()\n\nWhen building a kernel with KASAN this leads to the following KASAN report:\n\n[ 106.634504] ==================================================================\n[ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei\n[ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1\n[ 106.634729]\n[ 106.634767] Tainted: [E]=UNSIGNED_MODULE\n[ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025\n[ 106.634773] Call Trace:\n[ 106.634777]  <TASK>\n...\n[ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636)\n[ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei\n[ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei\n[ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei\n...\n[ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei\n[ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc\n[ 106.635066] platform_remove (drivers/base/platform.c:1424)\n\nAdd the missing mei_cldev_disable() calls so that the mei_cl gets removed\nfrom mei_device->file_list before it is freed to fix this."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is an SPI/MEI-attached Intel Visual Sensing Controller driver teardown path reached only from local device-model events (system shutdown, module unload, driver unbind); there is no network-facing component.\nAC:L - The use-after-free is fully deterministic — the mei_cl is unconditionally left on file_list after being kfree'd, so every mei_vsc teardown hits it — and the attacker both initiates the teardown and controls concurrent heap allocations during the multi-millisecond window between the kfree and the mei_cl_all_disconnect() walk.\nPR:L - Any unprivileged user with a local session on the affected laptops can trigger the path by requesting a shutdown/reboot, which logind/polkit permits without authentication by default (the KASAN trace's offending task is the systemd shutdown path). No root or capability is needed to reach the teardown.\nUI:N - The attacker initiates the shutdown/unbind themselves and the freed object is dereferenced automatically in the same code path; no action by a separate victim is required.\nS:U - The corruption and its consequences are confined to kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed struct mei_cl is read back (state, dev, me_cl, four wait_queue_heads) and the list traversal follows a dangling next pointer, so heap grooming of the reclaimed general-purpose slab object yields kernel memory disclosure primitives.\nI:H - The path writes into freed memory (cl->state assignment, list_del operations on freed list heads), does a kref_put through a freed me_cl pointer, and calls wake_up() on four freed wait queues — an indirect call through an attacker-controlled function pointer, i.e. a control-flow hijack primitive.\nA:H - Confirmed KASAN slab-use-after-free with a kernel oops on the shutdown path, reproducible on every reboot of affected hardware and readily escalated to a full panic via corrupted list traversal."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/pci/intel/ivsc/mei_ace.c","drivers/media/pci/intel/ivsc/mei_csi.c"],"versions":[{"version":"29006e196a5661d9afc8152fa2bf8a5347ac17b4","lessThan":"3c0e4cc4f55f9a1db2a761e4ffb27c9594245888","status":"affected","versionType":"git"},{"version":"29006e196a5661d9afc8152fa2bf8a5347ac17b4","lessThan":"639f5b33fcd7c59157f29b09f6f2866eacf9279c","status":"affected","versionType":"git"},{"version":"29006e196a5661d9afc8152fa2bf8a5347ac17b4","lessThan":"1dfe73394dcfc9b049c8da0dc181c45f156a5f49","status":"affected","versionType":"git"},{"version":"29006e196a5661d9afc8152fa2bf8a5347ac17b4","lessThan":"0c92c49fc688cfadacc47ae99b06a31237702e9e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/pci/intel/ivsc/mei_ace.c","drivers/media/pci/intel/ivsc/mei_csi.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.103","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.44","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.4","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.16.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3c0e4cc4f55f9a1db2a761e4ffb27c9594245888"},{"url":"https://git.kernel.org/stable/c/639f5b33fcd7c59157f29b09f6f2866eacf9279c"},{"url":"https://git.kernel.org/stable/c/1dfe73394dcfc9b049c8da0dc181c45f156a5f49"},{"url":"https://git.kernel.org/stable/c/0c92c49fc688cfadacc47ae99b06a31237702e9e"}],"title":"media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls","x_generator":{"engine":"bippy-1.2.0"}}}}