{"id":"CVE-2025-23151","revision":"9c4343c655264d388982a5415438d572","records":[{"revision":"9c4343c655264d388982a5415438d572","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-23151","aliases":[],"title":"bus: mhi: host: Fix race between unprepare and queue_buf","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Fix race between unprepare and queue_buf\n\nA client driver may use mhi_unprepare_from_transfer() to quiesce\nincoming data during the client driver's tear down. The client driver\nmight also be processing data at the same time, resulting in a call to\nmhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs\nafter mhi_unprepare_from_transfer() has torn down the channel, a panic\nwill occur due to an invalid dereference leading to a page fault.\n\nThis occurs because mhi_gen_tre() does not verify the channel state\nafter locking it. Fix this by having mhi_gen_tre() confirm the channel\nstate is valid, or return error to avoid accessing deinitialized data.\n\n[mani: added stable tag]","state":0,"publishedAt":"2025-05-01T12:55:38.833+00:00","modifiedAt":"2026-10-15T21:51:58.988+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bus/mhi/host/main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"176ed1727badd2fad2158e2b214dcbc24f4be7a1\",\n                            \"lessThan\": \"899d0353ea69681f474b6bc9de32c663b89672da\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0b093176fd0967a5f56e2c86b0d48247f6c0fa0f\",\n                            \"lessThan\": \"3e7ecf181cbdde9753204ada3883ca1704d8702b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce16274a6b8d1483d0d8383272deb2bfd1b577ca\",\n                            \"lessThan\": \"5f084993c90d9d0b4a52a349ede5120f992a7ca1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9\",\n                            \"lessThan\": \"a77955f7704b2a00385e232cbcc1cb06b5c7a425\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9\",\n                            \"lessThan\": \"178e5657c8fd285125cc6743a81b513bce099760\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9\",\n                            \"lessThan\": \"ee1fce83ed56450087309b9b74ad9bcb2b010fa6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9\",\n                            \"lessThan\": \"0686a818d77a431fc3ba2fab4b46bbb04e8c9380\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"642adb03541673f3897f64bbb62856ffd73807f5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.15.149\",\n                            \"lessThan\": \"5.15.181\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.76\",\n                            \"lessThan\": \"6.1.135\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.15\",\n                            \"lessThan\": \"6.6.88\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.3\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bus/mhi/host/main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.181\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.135\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.88\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.24\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.12\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14.3\",\n                            \"lessThanOrEqual\": \"6.14.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/899d0353ea69681f474b6bc9de32c663b89672da","https://git.kernel.org/stable/c/3e7ecf181cbdde9753204ada3883ca1704d8702b","https://git.kernel.org/stable/c/5f084993c90d9d0b4a52a349ede5120f992a7ca1","https://git.kernel.org/stable/c/a77955f7704b2a00385e232cbcc1cb06b5c7a425","https://git.kernel.org/stable/c/178e5657c8fd285125cc6743a81b513bce099760","https://git.kernel.org/stable/c/ee1fce83ed56450087309b9b74ad9bcb2b010fa6","https://git.kernel.org/stable/c/0686a818d77a431fc3ba2fab4b46bbb04e8c9380"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-23151","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-23151","identifiers":["CVE-2025-23151"]},"retained":false,"historicalAffected":[]}],"coverage":[]}