Vulnerability-Lookup

GHSA-F5FC-M65H-GR9J

Vulnerability from github – Published: 2025-07-25 15:30 – Updated: 2025-11-19 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Update read pointer only after buffer is written

Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element, resulting in data corruption.

Invoke the buffer write before updating rd_offset to ensure the element is fully written before signaling its availability.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38429"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-25T15:15:27Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability.",
  "id": "GHSA-f5fc-m65h-gr9j",
  "modified": "2025-11-19T21:31:17Z",
  "published": "2025-07-25T15:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38429"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38429 (GCVE-0-2025-38429)

Vulnerability from cvelistv5 – Published: 2025-07-25 14:16 – Updated: 2026-08-05 12:01

Title

bus: mhi: ep: Update read pointer only after buffer is written

Summary

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after buffer is written Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element, resulting in data corruption. Invoke the buffer write before updating rd_offset to ensure the element is fully written before signaling its availability.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/44b9620e82bbec2b9…
https://git.kernel.org/stable/c/f704a80d9fa268e51…
https://git.kernel.org/stable/c/0007ef098dab48f1b…
https://git.kernel.org/stable/c/6f18d174b73d0ceea…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 , < 44b9620e82bbec2b9a6ac77f63913636d84f96dc (git) Affected: bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 , < f704a80d9fa268e51a6cc5242714502c3c1fa605 (git) Affected: bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 , < 0007ef098dab48f1ba58364c40b4809f1e21b130 (git) Affected: bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 , < 6f18d174b73d0ceeaa341f46c0986436b3aefc9a (git)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 6.6.95 , ≤ 6.6.* (semver) Unaffected: 6.12.35 , ≤ 6.12.* (semver) Unaffected: 6.15.4 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bus/mhi/ep/ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44b9620e82bbec2b9a6ac77f63913636d84f96dc",
              "status": "affected",
              "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
              "versionType": "git"
            },
            {
              "lessThan": "f704a80d9fa268e51a6cc5242714502c3c1fa605",
              "status": "affected",
              "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
              "versionType": "git"
            },
            {
              "lessThan": "0007ef098dab48f1ba58364c40b4809f1e21b130",
              "status": "affected",
              "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
              "versionType": "git"
            },
            {
              "lessThan": "6f18d174b73d0ceeaa341f46c0986436b3aefc9a",
              "status": "affected",
              "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bus/mhi/ep/ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - MHI EP is the WWAN/modem datapath; event-ring insertions are generated per transfer completion for data crossing the link, including downlink packets originating from remote network peers, so a remote party driving traffic exercises the racy path with no local access to either side.\nAC:L - The window between the MMIO rp publish and the eDMA element write is microseconds wide and the host polls rp continuously, so the race hits under ordinary traffic \u2014 the upstream host-side fix describes it as \"the usual pattern\" observed in practice, not a rare interleaving.\nPR:N - No capability check, authentication step, or privilege gate exists anywhere along the path from traffic arrival to mhi_ep_ring_add_element(); event generation is driven purely by host doorbells and channel data movement.\nUI:N - The stale-element exposure occurs during normal automatic MHI event-ring operation; no victim action such as mounting, opening a device, or loading a module is required.\nS:C - The defect is in the endpoint\u0027s kernel MHI stack, but the resulting double free and DMA-unmap corruption occur in the host kernel on the other side of the PCIe link \u2014 a distinct processor and security authority, analogous to a device/DMA boundary crossing.\nC:H - The host consumes an uninitialized or stale ring element and dereferences attacker-influenced TRE pointers, and the resulting use-after-free over already-completed buffers gives control of freed object contents suitable for arbitrary kernel memory disclosure.\nI:H - Upstream explicitly documents that this ordering bug causes the host to double-free transfer buffers and re-unmap DMA mappings, which is heap corruption exploitable for arbitrary write and control-flow hijack.\nA:H - Double free, DMA unmap of already-unmapped buffers, and pending_pkts refcount underflow reliably oops or panic the host kernel and desynchronize the ring, tearing down the MHI link."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:49.263Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605"
        },
        {
          "url": "https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a"
        }
      ],
      "title": "bus: mhi: ep: Update read pointer only after buffer is written",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38429",
    "datePublished": "2025-07-25T14:16:48.698Z",
    "dateReserved": "2025-04-16T04:51:24.015Z",
    "dateUpdated": "2026-08-05T12:01:49.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.