High 7.8Published Sep 5, 2025

CVE-2025-39711media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls

Updated under an hour ago (Oct 27, 2026, 7:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling kfree(cldev->cl). This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing the just freed cldev->cl. And mei_vsc_remove() it self is run at shutdown because of the platform_device_unregister(tp->pdev) in vsc_tp_shutdown() When building a kernel with KASAN this leads to the following KASAN report: [ 106.634504] ================================================================== [ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1 [ 106.634729] [ 106.634767] Tainted: [E]=UNSIGNED_MODULE [ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025 [ 106.634773] Call Trace: [ 106.634777] <TASK> ... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [ 106.635066] platform_remove (drivers/base/platform.c:1424) Add the missing mei_cldev_disable() calls so that the mei_cl gets removed from mei_device->file_list before it is freed to fix this.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	29006e196a5661d9afc8152fa2bf8a5347ac17b4 builds before 3c0e4cc4f55f9a1db2a761e4ffb27c9594245888; 29006e196a5661d9afc8152fa2bf8a5347ac17b4 builds before 639f5b33fcd7c59157f29b09f6f2866eacf9279c; 29006e196a5661d9afc8152fa2bf8a5347ac17b4 builds before 1dfe73394dcfc9b049c8da0dc181c45f156a5f49; 29006e196a5661d9afc8152fa2bf8a5347ac17b4 builds before 0c92c49fc688cfadacc47ae99b06a31237702e9e	CNA record
linux linux_kernel linux:linux_kernel	from 6.6 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4	NVD

References

References

https://git.kernel.org/stable/c/3c0e4cc4f55f9a1db2a761e4ffb27c9594245888	patch
https://git.kernel.org/stable/c/639f5b33fcd7c59157f29b09f6f2866eacf9279c	patch
https://git.kernel.org/stable/c/1dfe73394dcfc9b049c8da0dc181c45f156a5f49	patch
https://git.kernel.org/stable/c/0c92c49fc688cfadacc47ae99b06a31237702e9e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.