{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"08baf418d79d289a7bc38be519289b3a48b83da9","status":"affected","version":"3703f53b99e4a7c373ce3568dd3f91f175ebb626","versionType":"git"},{"lessThan":"cde7f709d1025dadfc52e903e43981c1644bd8bd","status":"affected","version":"3703f53b99e4a7c373ce3568dd3f91f175ebb626","versionType":"git"},{"lessThan":"0b605e8ce60698c27a26f512968a597fd620d2e8","status":"affected","version":"3703f53b99e4a7c373ce3568dd3f91f175ebb626","versionType":"git"},{"lessThan":"feb4bcfd405282de60aba321f13a1272b30c5af4","status":"affected","version":"3703f53b99e4a7c373ce3568dd3f91f175ebb626","versionType":"git"},{"lessThan":"272dac57caa981718e7188c80c703e7bb1998054","status":"affected","version":"3703f53b99e4a7c373ce3568dd3f91f175ebb626","versionType":"git"},{"lessThan":"56f7db581ee73af53cd512e00a6261a025bf1d58","status":"affected","version":"3703f53b99e4a7c373ce3568dd3f91f175ebb626","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.14","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-45877","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients\n\nDuring a warm reset flow, the cl->device pointer may be NULL if the\nreset occurs while clients are still being enumerated. Accessing\ncl->device->reference_count without a NULL check leads to a kernel panic.\n\nThis issue was identified during multi-unit warm reboot stress clycles.\nAdd a defensive NULL check for cl->device to ensure stability under\nsuch intensive testing conditions.\n\nKASAN: null-ptr-deref in range [0000000000000000-0000000000000007]\nWorkqueue: ish_fw_update_wq fw_reset_work_fn\n\nCall Trace:\n ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp]\n ishtp_reset_handler+0x85/0x1a0 [intel_ishtp]\n fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc]","epss":{"date":"2026-11-06","percentile":0.07904,"score":0.00183},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793980390380,"publishedAt":1779884206910,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/08baf418d79d289a7bc38be519289b3a48b83da9"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/cde7f709d1025dadfc52e903e43981c1644bd8bd"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/0b605e8ce60698c27a26f512968a597fd620d2e8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/feb4bcfd405282de60aba321f13a1272b30c5af4"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/272dac57caa981718e7188c80c703e7bb1998054"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58"}],"remediation":[],"revision":"edf9888edb2a68219d5decb2eca100efcd8592ed21662fae49701375bdd9964e","sources":[{"modifiedAt":1793980390380,"name":"CNA: Linux","retrievedAt":1793981758656,"url":"https://www.cve.org/CVERecord?id=CVE-2026-45877"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793981787790,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45877"}],"ssvc":{"assessedAt":1793979797487,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients","updatedAt":1793981787790}