{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38429", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.015Z", "datePublished": "2025-07-25T14:16:48.698Z", "dateUpdated": "2026-08-05T12:01:49.263Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:49.263Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - MHI EP is the WWAN/modem datapath; event-ring insertions are generated per transfer completion for data crossing the link, including downlink packets originating from remote network peers, so a remote party driving traffic exercises the racy path with no local access to either side.\nAC:L - The window between the MMIO rp publish and the eDMA element write is microseconds wide and the host polls rp continuously, so the race hits under ordinary traffic — the upstream host-side fix describes it as \"the usual pattern\" observed in practice, not a rare interleaving.\nPR:N - No capability check, authentication step, or privilege gate exists anywhere along the path from traffic arrival to mhi_ep_ring_add_element(); event generation is driven purely by host doorbells and channel data movement.\nUI:N - The stale-element exposure occurs during normal automatic MHI event-ring operation; no victim action such as mounting, opening a device, or loading a module is required.\nS:C - The defect is in the endpoint's kernel MHI stack, but the resulting double free and DMA-unmap corruption occur in the host kernel on the other side of the PCIe link — a distinct processor and security authority, analogous to a device/DMA boundary crossing.\nC:H - The host consumes an uninitialized or stale ring element and dereferences attacker-influenced TRE pointers, and the resulting use-after-free over already-completed buffers gives control of freed object contents suitable for arbitrary kernel memory disclosure.\nI:H - Upstream explicitly documents that this ordering bug causes the host to double-free transfer buffers and re-unmap DMA mappings, which is heap corruption exploitable for arbitrary write and control-flow hijack.\nA:H - Double free, DMA unmap of already-unmapped buffers, and pending_pkts refcount underflow reliably oops or panic the host kernel and desynchronize the ring, tearing down the MHI link." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/bus/mhi/ep/ring.c" ], "versions": [ { "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "44b9620e82bbec2b9a6ac77f63913636d84f96dc", "status": "affected", "versionType": "git" }, { "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "f704a80d9fa268e51a6cc5242714502c3c1fa605", "status": "affected", "versionType": "git" }, { "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "0007ef098dab48f1ba58364c40b4809f1e21b130", "status": "affected", "versionType": "git" }, { "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "6f18d174b73d0ceeaa341f46c0986436b3aefc9a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/bus/mhi/ep/ring.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.15.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc" }, { "url": "https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605" }, { "url": "https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130" }, { "url": "https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a" } ], "title": "bus: mhi: ep: Update read pointer only after buffer is written", "x_generator": { "engine": "bippy-1.2.0" } } } }