SECUFOCUSNOW
Home›CVE index›CVE-2025-39711
Review reviewHigh

CVE-2025-39711

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling kfree(cldev->cl). This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.09.06
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling kfree(cldev->cl). This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 29006e196a5661d9afc8152fa2bf8a5347ac17b4 < 3c0e4cc4f55f9a1db2a761e4ffb27c9594245888, >= 29006e196a5661d9afc8152fa2bf8a5347ac17b4 < 639f5b33fcd7c59157f29b09f6f2866eacf9279c, >= 29006e196a5661d9afc8152fa2bf8a5347ac17b4 < 1dfe73394dcfc9b049c8da0dc181c45f156a5f49, >= 29006e196a5661d9afc8152fa2bf8a5347ac17b4 < 0c92c49fc688cfadacc47ae99b06a31237702e9e, >= 6.6, >= 6.6 < 6.6.103, >= 6.7 < 6.12.44, >= 6.13 < 6.16.4
Fixed versions
6.6.103, 6.12.44, 6.16.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416