CVE-2025-23151

MEDIUM EPSS 1.8%
Published May 1, 20251y ago · Modified Jun 17, 20262w ago
4.7 CVSS 3.1
Medium
Find Similar
Published May 1, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag]

CVSS Details

Base Score
4.7
Exploitability
1.0
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
1.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-362

Affected Products 7

VendorProductVersionRange
linuxlinux_kernel*≥5.15.149  –  <5.15.181
linuxlinux_kernel*≥6.1.76  –  <6.1.135
linuxlinux_kernel*≥6.6.15  –  <6.6.88
linuxlinux_kernel*≥6.7.3  –  <6.12.24
linuxlinux_kernel*≥6.13  –  <6.13.12
linuxlinux_kernel*≥6.14  –  <6.14.3
debiandebian_linux11.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/0686a818d77a431fc3ba2fab4b46bbb04e8c9380
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/178e5657c8fd285125cc6743a81b513bce099760
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3e7ecf181cbdde9753204ada3883ca1704d8702b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5f084993c90d9d0b4a52a349ede5120f992a7ca1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/899d0353ea69681f474b6bc9de32c663b89672da
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a77955f7704b2a00385e232cbcc1cb06b5c7a425
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ee1fce83ed56450087309b9b74ad9bcb2b010fa6
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
    Mailing List

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/0686a818d77a431fc3ba2fab4b46bbb04e8c9380
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/178e5657c8fd285125cc6743a81b513bce099760
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3e7ecf181cbdde9753204ada3883ca1704d8702b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5f084993c90d9d0b4a52a349ede5120f992a7ca1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/899d0353ea69681f474b6bc9de32c663b89672da
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a77955f7704b2a00385e232cbcc1cb06b5c7a425
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ee1fce83ed56450087309b9b74ad9bcb2b010fa6
    Patch