HID: intel-ish-hid: Fix kernel panic during warm reset
Summary
| CVE | CVE-2023-53392 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-09-18 14:15:42 UTC |
| Updated | 2026-11-05 21:17:19 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix kernel panic during warm reset During warm reset device->fw_client is set to NULL. If a bus driver is registered after this NULL setting and before new firmware clients are enumerated by ISHTP, kernel panic will result in the function ishtp_cl_bus_match(). This is because of reference to device->fw_client->props.protocol_name. ISH firmware after getting successfully loaded, sends a warm reset notification to remove all clients from the bus and sets device->fw_client to NULL. Until kernel v5.15, all enabled ISHTP kernel module drivers were loaded right after any of the first ISHTP device was registered, regardless of whether it was a matched or an unmatched device. This resulted in all drivers getting registered much before the warm reset notification from ISH. Starting kernel v5.16, this issue got exposed after the change was introduced to load only bus drivers for the respective matching devices. In this scenario, cros_ec_ishtp device and cros_ec_ishtp driver are registered after the warm reset device fw_client NULL setting. cros_ec_ishtp driver_register() triggers the callback to ishtp_cl_bus_match() to match ISHTP driver to the device and causes kernel panic in guid_equal() when dereferencing fw_client NULL pointer to get protocol_name. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Problem Types: NVD-CWE-noinfo
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 44e2a58cb8803e3e40eaf5708c4d15b4118913c4 6c8cc40c588f8080a164d88336b1490279e0f1da git | Not specified |
| CNA | Linux | Linux | affected 44e2a58cb8803e3e40eaf5708c4d15b4118913c4 45b9055a3a3ff6e8c08faad82ea36a8644a81587 git | Not specified |
| CNA | Linux | Linux | affected 44e2a58cb8803e3e40eaf5708c4d15b4118913c4 38518593ec55e897abda4b4be77b2ec8ec4447d1 git | Not specified |
| CNA | Linux | Linux | affected 5.16 | Not specified |
| CNA | Linux | Linux | unaffected 5.16 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.25 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.2.12 6.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.3 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/6c8cc40c588f8080a164d88336b1490279e0f1da | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/38518593ec55e897abda4b4be77b2ec8ec4447d1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/45b9055a3a3ff6e8c08faad82ea36a8644a81587 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.