CVE-2025-23151
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
bus: mhi: host: Fix race between unprepare and queue_buf
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag]
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 176ed1727badd2fad2158e2b214dcbc24f4be7a1 | affected | git | 899d0353ea69681f474b6bc9de32c663b89672da | Unavailable | None listed |
| 0b093176fd0967a5f56e2c86b0d48247f6c0fa0f | affected | git | 3e7ecf181cbdde9753204ada3883ca1704d8702b | Unavailable | None listed |
| ce16274a6b8d1483d0d8383272deb2bfd1b577ca | affected | git | 5f084993c90d9d0b4a52a349ede5120f992a7ca1 | Unavailable | None listed |
| b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 | affected | git | a77955f7704b2a00385e232cbcc1cb06b5c7a425 | Unavailable | None listed |
| b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 | affected | git | 178e5657c8fd285125cc6743a81b513bce099760 | Unavailable | None listed |
| b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 | affected | git | ee1fce83ed56450087309b9b74ad9bcb2b010fa6 | Unavailable | None listed |
| b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 | affected | git | 0686a818d77a431fc3ba2fab4b46bbb04e8c9380 | Unavailable | None listed |
| 642adb03541673f3897f64bbb62856ffd73807f5 | affected | git | Unavailable | Unavailable | None listed |
| 5.15.149 | affected | semver | 5.15.181 | Unavailable | None listed |
| 6.1.76 | affected | semver | 6.1.135 | Unavailable | None listed |
| 6.6.15 | affected | semver | 6.6.88 | Unavailable | None listed |
| 6.7.3 | affected | semver | 6.8 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.8 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.8 | Unavailable | None listed |
| 5.15.181 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.135 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.88 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.24 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.13.12 | unaffected | semver | Unavailable | 6.13.* | None listed |
| 6.14.3 | unaffected | semver | Unavailable | 6.14.* | None listed |
| 6.15 | unaffected | original_commit_for_fix | Unavailable | * | None listed |