CVE-2025-38429

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38429", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.015Z", "datePublished": "2025-07-25T14:16:48.698Z", "dateUpdated": "2026-10-30T12:21:58.744Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:21:58.744Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - MHI EP is the WWAN/modem datapath; event-ring insertions are generated per transfer completion for data crossing the link, including downlink packets originating from remote network peers, so a remote party driving traffic exercises the racy path with no local access to either side.\nAC:L - The window between the MMIO rp publish and the eDMA element write is microseconds wide and the host polls rp continuously, so the race hits under ordinary traffic \u2014 the upstream host-side fix describes it as \"the usual pattern\" observed in practice, not a rare interleaving.\nPR:N - No capability check, authentication step, or privilege gate exists anywhere along the path from traffic arrival to mhi_ep_ring_add_element(); event generation is driven purely by host doorbells and channel data movement.\nUI:N - The stale-element exposure occurs during normal automatic MHI event-ring operation; no victim action such as mounting, opening a device, or loading a module is required.\nS:C - The defect is in the endpoint's kernel MHI stack, but the resulting double free and DMA-unmap corruption occur in the host kernel on the other side of the PCIe link \u2014 a distinct processor and security authority, analogous to a device/DMA boundary crossing.\nC:H - The host consumes an uninitialized or stale ring element and dereferences attacker-influenced TRE pointers, and the resulting use-after-free over already-completed buffers gives control of freed object contents suitable for arbitrary kernel memory disclosure.\nI:H - Upstream explicitly documents that this ordering bug causes the host to double-free transfer buffers and re-unmap DMA mappings, which is heap corruption exploitable for arbitrary write and control-flow hijack.\nA:H - Double free, DMA unmap of already-unmapped buffers, and pending_pkts refcount underflow reliably oops or panic the host kernel and desynchronize the ring, tearing down the MHI link."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bus/mhi/ep/ring.c"], "versions": [{"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "e2176aa3ba4361e98d9f91178a762dca6cf21fe0", "status": "affected", "versionType": "git"}, {"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "44b9620e82bbec2b9a6ac77f63913636d84f96dc", "status": "affected", "versionType": "git"}, {"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "f704a80d9fa268e51a6cc5242714502c3c1fa605", "status": "affected", "versionType": "git"}, {"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "0007ef098dab48f1ba58364c40b4809f1e21b130", "status": "affected", "versionType": "git"}, {"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "lessThan": "6f18d174b73d0ceeaa341f46c0986436b3aefc9a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bus/mhi/ep/ring.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.15.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e2176aa3ba4361e98d9f91178a762dca6cf21fe0"}, {"url": "https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc"}, {"url": "https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605"}, {"url": "https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130"}, {"url": "https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a"}], "title": "bus: mhi: ep: Update read pointer only after buffer is written", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bus/mhi/ep/ring.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e2176aa3ba4361e98d9f91178a762dca6cf21fe0", "status": "affected", "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "versionType": "git"}, {"lessThan": "44b9620e82bbec2b9a6ac77f63913636d84f96dc", "status": "affected", "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "versionType": "git"}, {"lessThan": "f704a80d9fa268e51a6cc5242714502c3c1fa605", "status": "affected", "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "versionType": "git"}, {"lessThan": "0007ef098dab48f1ba58364c40b4809f1e21b130", "status": "affected", "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "versionType": "git"}, {"lessThan": "6f18d174b73d0ceeaa341f46c0986436b3aefc9a", "status": "affected", "version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bus/mhi/ep/ring.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.95", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.35", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE04B7DB-622C-4B50-A6A2-AB2F288FC85C", "versionEndExcluding": "6.6.95", "versionStartIncluding": "5.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E569FD34-0076-4428-BE17-EECCF867611C", "versionEndExcluding": "6.12.35", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655", "versionEndExcluding": "6.15.4", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bus: mhi: ep: Actualizar el puntero de lectura solo despu\u00e9s de escribir en el b\u00fafer. Dentro de mhi_ep_ring_add_element, el puntero de lectura (rd_offset) se actualiza antes de escribir en el b\u00fafer, lo que podr\u00eda causar condiciones de ejecuci\u00f3n donde el host ve un puntero de lectura actualizado antes de que se escriba en el b\u00fafer. Actualizar rd_offset prematuramente puede provocar que el host acceda a un elemento no inicializado o incompleto, lo que resulta en corrupci\u00f3n de datos. Invoque la escritura en el b\u00fafer antes de actualizar rd_offset para garantizar que el elemento est\u00e9 completamente escrito antes de indicar su disponibilidad."}], "id": "CVE-2025-38429", "lastModified": "2026-10-30T13:18:05.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-25T15:15:27.870", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2176aa3ba4361e98d9f91178a762dca6cf21fe0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bus: mhi: ep: Update read pointer only after buffer is written", "id": "2383450", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383450"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbus: mhi: ep: Update read pointer only after buffer is written\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability."], "name": "CVE-2025-38429", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38429\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38429\nhttps://lore.kernel.org/linux-cve-announce/2025072556-CVE-2025-38429-f662@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-26T12:07:32.050924+00:00", "updated": "2025-07-26T12:07:32.050986+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}