{"id":"CVE-2025-38429","state":"PUBLISHED","title":"bus: mhi: ep: Update read pointer only after buffer is written","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability.","publishedAt":"2025-07-25T14:16:48.698Z","updatedAt":"2026-10-30T12:21:58.744Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"e2176aa3ba4361e98d9f91178a762dca6cf21fe0","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"44b9620e82bbec2b9a6ac77f63913636d84f96dc","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"f704a80d9fa268e51a6cc5242714502c3c1fa605","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"0007ef098dab48f1ba58364c40b4809f1e21b130","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"6f18d174b73d0ceeaa341f46c0986436b3aefc9a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bus/mhi/ep/ring.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.95","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.35","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.4","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bus/mhi/ep/ring.c"]}],"references":["https://git.kernel.org/stable/c/e2176aa3ba4361e98d9f91178a762dca6cf21fe0","https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc","https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605","https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130","https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a"],"weaknesses":[],"ingestedAt":"2026-10-30T12:38:04.623Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38429.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38429","state":"PUBLISHED","datePublished":"2025-07-25T14:16:48.698Z","dateUpdated":"2026-10-30T12:21:58.744Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.015Z"},"containers":{"cna":{"title":"bus: mhi: ep: Update read pointer only after buffer is written","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"e2176aa3ba4361e98d9f91178a762dca6cf21fe0","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"44b9620e82bbec2b9a6ac77f63913636d84f96dc","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"f704a80d9fa268e51a6cc5242714502c3c1fa605","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"0007ef098dab48f1ba58364c40b4809f1e21b130","versionType":"git"},{"version":"bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34","status":"affected","lessThan":"6f18d174b73d0ceeaa341f46c0986436b3aefc9a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bus/mhi/ep/ring.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.95","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.35","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.4","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bus/mhi/ep/ring.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e2176aa3ba4361e98d9f91178a762dca6cf21fe0"},{"url":"https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc"},{"url":"https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605"},{"url":"https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130"},{"url":"https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - MHI EP is the WWAN/modem datapath; event-ring insertions are generated per transfer completion for data crossing the link, including downlink packets originating from remote network peers, so a remote party driving traffic exercises the racy path with no local access to either side.\nAC:L - The window between the MMIO rp publish and the eDMA element write is microseconds wide and the host polls rp continuously, so the race hits under ordinary traffic — the upstream host-side fix describes it as \"the usual pattern\" observed in practice, not a rare interleaving.\nPR:N - No capability check, authentication step, or privilege gate exists anywhere along the path from traffic arrival to mhi_ep_ring_add_element(); event generation is driven purely by host doorbells and channel data movement.\nUI:N - The stale-element exposure occurs during normal automatic MHI event-ring operation; no victim action such as mounting, opening a device, or loading a module is required.\nS:C - The defect is in the endpoint's kernel MHI stack, but the resulting double free and DMA-unmap corruption occur in the host kernel on the other side of the PCIe link — a distinct processor and security authority, analogous to a device/DMA boundary crossing.\nC:H - The host consumes an uninitialized or stale ring element and dereferences attacker-influenced TRE pointers, and the resulting use-after-free over already-completed buffers gives control of freed object contents suitable for arbitrary kernel memory disclosure.\nI:H - Upstream explicitly documents that this ordering bug causes the host to double-free transfer buffers and re-unmap DMA mappings, which is heap corruption exploitable for arbitrary write and control-flow hijack.\nA:H - Double free, DMA unmap of already-unmapped buffers, and pending_pkts refcount underflow reliably oops or panic the host kernel and desynchronize the ring, tearing down the MHI link."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:21:58.744Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.95"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.12.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.15.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}