CVE-2025-68804

What it actually does

Use-after-free in cros_ec_ishtp driver: cros_ec_console_log_work kthread continues accessing the EC device after .remove() unbinds the driver without unregistering the EC device for synchronous shutdown.

Why it matters to the business

Kernel crashes and system instability on affected Linux kernels when the driver is unbound, impacting Chrome OS and embedded platforms that rely on cros_ec_ishtp for EC communication.

How an attack unfolds

An attacker or local process triggers driver unbind; the lingering kthread then dereferences freed memory, resulting in UAF and crash. No named threat actors or ransomware campaigns are associated.

How to fix it

Update the Linux kernel to the fixed commit 27037916db38e6b78a0242031d3b93d997b84020 or later stable releases containing the patch that unregisters the EC device synchronously in .remove().

How to confirm the fix worked

Confirm the fix commit is present in the running kernel tree or verify updated package versions; test driver bind/unbind cycles for absence of crashes.

Typical attack path

1. Trigger unbind of cros_ec_ishtp driver via sysfs or module removal
2. Allow cros_ec_console_log_work kthread to execute after device memory is freed
3. Trigger dereference of dangling pointer leading to kernel panic

How to detect it

Inspect kernel crash dumps and logs for oops traces referencing cros_ec_console_log_work, cros_ec_ishtp, and use-after-free conditions in platform/chrome.

What your security team should do

• Apply the kernel fix immediately on all affected systems
• Prioritize patching in environments using Chrome EC hardware
• Monitor kernel logs for related UAF oops during driver lifecycle testing