Skip to content
Heist/ feed
High

bus: mhi: host: Detect events pointing to unexpected TREs

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims

Announced Source revision 1
Original source ↗

CVE-2025-39790

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-39790

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
        "lessThan": "7b3f0e3b60c27f4fcb69927d84987e5fd6240530",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
        "lessThan": "4079c6c59705b96285219b9efc63cab870d757b7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
        "lessThan": "5e17429679a8545afe438ce7a82a13a54e8ceabb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
        "lessThan": "2ec99b922f4661521927eeada76f431eebfbabc4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
        "lessThan": "44e1a079e18f78d6594a715b0c6d7e18c656f7b9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
        "lessThan": "5bd398e20f0833ae8a1267d4f343591a2dd20185",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/bus/mhi/host/main.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.7"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.7",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.190",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.149",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.103",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.44",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.16.4",
        "versionType": "semver",
        "lessThanOrEqual": "6.16.*"
      },
      {
        "status": "unaffected",
        "version": "6.17",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/bus/mhi/host/main.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-39790

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30628 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement