Linux Kernel CVE-2026-45877

Exploitation requires all of the following: (1) the target system must be equipped with Intel ISH hardware (Intel SoC platforms, primarily Intel-based laptops and 2-in-1 devices) with the intel_ishtp and intel_ish_ipc kernel modules loaded; (2) a warm reset must be triggered via the ISH firmware update workqueue (ish_fw_update_wq) precisely while ISH clients are mid-enumeration - this is a race condition with a narrow timing window; (3) local system access with at minimum low-privilege rights per CVSS PR:L. Exploitation is NOT possible on systems without Intel ISH hardware, on systems where ISH kernel modules are blacklisted or not loaded, or over any network vector. The race condition nature means the crash is non-deterministic and requires repeated reset cycles to reliably trigger, as confirmed by the multi-unit warm reboot stress test context in the CVE description.

The NVD-assigned CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly captures the local, low-privilege, availability-only impact profile. However, AC:L may understate complexity: the description explicitly identifies this as a race condition requiring that a warm reset occur while clients are still being enumerated - a narrow timing window observed only under multi-unit warm reboot stress cycles. An independent assessment of AC:H is more defensible. EPSS at 0.02% (5th percentile) and absence from CISA KEV confirm this is not under active exploitation and has attracted minimal attacker interest. No public POC exists. The real-world risk is limited to Intel ISH-equipped systems (predominantly Intel-platform laptops and embedded devices) running unpatched stable kernels, and only manifests under specific reset-during-enumeration timing conditions. This is a low-priority patching item except for operators of high-availability ISH-dependent embedded or IoT fleets subject to frequent firmware update cycles.

A local user or automated process on an Intel ISH-equipped laptop triggers a firmware reset cycle (e.g., via ISH firmware update), while the kernel's ish_fw_update_wq workqueue runs fw_reset_work_fn concurrently with ISH client enumeration. If the reset handler reaches ishtp_bus_remove_all_clients() before cl->device is assigned for a partially-initialized client, dereferencing cl->device->reference_count causes an immediate kernel panic and system crash. No public POC exists; this scenario was observed during internal multi-unit warm reboot stress testing.