CVE-2026-45877

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Linux Kernel HID Subsystem

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients During a warm reset flow, the cl->device pointer may be NULL if the reset occurs while clients are still being enumerated. Accessing cl->device->reference_count without a NULL check leads to a kernel panic. This issue was identified during multi-unit warm reboot stress clycles. Add a defensive NULL check for cl->device to ensure stability under such intensive testing conditions. KASAN: null-ptr-deref in range [0000000000000000-0000000000000007] Workqueue: ish_fw_update_wq fw_reset_work_fn Call Trace: ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp] ishtp_reset_handler+0x85/0x1a0 [intel_ishtp] fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45877

EUVD

EUVD-2026-32343

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 4.9 (inc) to 6.12.75 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's intel-ish-hid driver. During a warm reset process, a pointer named cl->device may be NULL if the reset happens while clients are still being enumerated. The code attempts to access cl->device->reference_count without first checking if cl->device is NULL, which leads to a NULL pointer dereference and causes a kernel panic.

The issue was discovered during intensive multi-unit warm reboot stress testing. The fix involves adding a defensive NULL check for cl->device to prevent the kernel panic and improve system stability.

Impact Analysis

This vulnerability can cause the Linux kernel to panic during a warm reset if the system attempts to access a NULL pointer. A kernel panic results in a system crash, causing downtime and potential loss of unsaved data. It may affect system stability and reliability, especially in environments where warm resets or reboots are frequent.

Detection Guidance

This vulnerability manifests as a kernel panic caused by a NULL pointer dereference in the intel-ish-hid driver during a warm reset when clients are still being enumerated.

To detect this issue on your system, you can monitor kernel logs for panic messages related to the intel_ishtp or intel_ish_ipc modules.

Check kernel logs for panic or oops messages: sudo dmesg | grep -i 'intel_ishtp\|intel_ish_ipc\|panic'
Use journalctl to review recent kernel messages: sudo journalctl -k | grep -i 'intel_ishtp\|intel_ish_ipc\|panic'
Look for call traces referencing ishtp_bus_remove_all_clients or fw_reset_work_fn in kernel logs.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a version where the NULL pointer dereference in the intel-ish-hid driver has been fixed.

Until an update is applied, avoid performing warm resets or reboot cycles that could trigger the enumeration of clients in the intel-ish-hid driver.

Monitoring system stability and kernel logs for signs of this issue can help in early detection and response.

Hi! I’m here to help you understand CVE-2026-45877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70