In the Linux kernel, the following vulnerability has been resolved:
bus: mhi: host: Fix race between unprepare and queue_buf
A client driver may use mhiunpreparefromtransfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhiqueuebuf() which will invoke mhigentre(). If mhigentre() runs after mhiunpreparefromtransfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault.
This occurs because mhigentre() does not verify the channel state after locking it. Fix this by having mhigentre() confirm the channel state is valid, or return error to avoid accessing deinitialized data.
[mani: added stable tag]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f084993c90d9d0b4a52a349ede5120f992a7ca1",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-06baea81",
"target": {
"function": "mhi_gen_tre",
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "313150500143964393621208542251292422495"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@899d0353ea69681f474b6bc9de32c663b89672da",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-093061ef",
"target": {
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222574974953383264005877797053052386709",
"138253156854892865874529209275773548712",
"276120025014635244053667853540368839648",
"89989593375907120993299198071509580957",
"190029770412086532925588174041361257345",
"172316240001217717729027908398793680534",
"321940102515040812487759695957378045808",
"172880770372238853955178516225426286088",
"138561414629303262103521737738559383191",
"328254823487141607561714741081887997203",
"183546667564152096459925091973790552554",
"258715187216143011850746782849750065037",
"81280218609949641830785260431254955075",
"254320073461186772991849695767961521235",
"66307522437024110800864266951004654648",
"84356470515671063269944926416628685290",
"317654504538636784417338848810879488225"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e7ecf181cbdde9753204ada3883ca1704d8702b",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-0af3eb08",
"target": {
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222574974953383264005877797053052386709",
"138253156854892865874529209275773548712",
"276120025014635244053667853540368839648",
"89989593375907120993299198071509580957",
"190029770412086532925588174041361257345",
"172316240001217717729027908398793680534",
"321940102515040812487759695957378045808",
"172880770372238853955178516225426286088",
"138561414629303262103521737738559383191",
"328254823487141607561714741081887997203",
"183546667564152096459925091973790552554",
"258715187216143011850746782849750065037",
"81280218609949641830785260431254955075",
"254320073461186772991849695767961521235",
"66307522437024110800864266951004654648",
"84356470515671063269944926416628685290",
"317654504538636784417338848810879488225"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0686a818d77a431fc3ba2fab4b46bbb04e8c9380",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-0ff4d231",
"target": {
"function": "mhi_gen_tre",
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Function",
"digest": {
"length": 1116.0,
"function_hash": "240752375936065141592008159814999268736"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee1fce83ed56450087309b9b74ad9bcb2b010fa6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-1395b017",
"target": {
"function": "mhi_gen_tre",
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Function",
"digest": {
"length": 1116.0,
"function_hash": "240752375936065141592008159814999268736"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e7ecf181cbdde9753204ada3883ca1704d8702b",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-20e154c6",
"target": {
"function": "mhi_gen_tre",
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "313150500143964393621208542251292422495"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee1fce83ed56450087309b9b74ad9bcb2b010fa6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-28a3fba0",
"target": {
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222574974953383264005877797053052386709",
"138253156854892865874529209275773548712",
"276120025014635244053667853540368839648",
"89989593375907120993299198071509580957",
"190029770412086532925588174041361257345",
"172316240001217717729027908398793680534",
"321940102515040812487759695957378045808",
"172880770372238853955178516225426286088",
"138561414629303262103521737738559383191",
"328254823487141607561714741081887997203",
"183546667564152096459925091973790552554",
"258715187216143011850746782849750065037",
"76105695026484211552944550550222938940",
"254320073461186772991849695767961521235",
"66307522437024110800864266951004654648",
"84356470515671063269944926416628685290",
"317654504538636784417338848810879488225"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@178e5657c8fd285125cc6743a81b513bce099760",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-31a83a1e",
"target": {
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222574974953383264005877797053052386709",
"138253156854892865874529209275773548712",
"276120025014635244053667853540368839648",
"89989593375907120993299198071509580957",
"190029770412086532925588174041361257345",
"172316240001217717729027908398793680534",
"321940102515040812487759695957378045808",
"172880770372238853955178516225426286088",
"138561414629303262103521737738559383191",
"328254823487141607561714741081887997203",
"183546667564152096459925091973790552554",
"258715187216143011850746782849750065037",
"76105695026484211552944550550222938940",
"254320073461186772991849695767961521235",
"66307522437024110800864266951004654648",
"84356470515671063269944926416628685290",
"317654504538636784417338848810879488225"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0686a818d77a431fc3ba2fab4b46bbb04e8c9380",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-4795ab72",
"target": {
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222574974953383264005877797053052386709",
"138253156854892865874529209275773548712",
"276120025014635244053667853540368839648",
"89989593375907120993299198071509580957",
"190029770412086532925588174041361257345",
"172316240001217717729027908398793680534",
"321940102515040812487759695957378045808",
"172880770372238853955178516225426286088",
"138561414629303262103521737738559383191",
"328254823487141607561714741081887997203",
"183546667564152096459925091973790552554",
"258715187216143011850746782849750065037",
"76105695026484211552944550550222938940",
"254320073461186772991849695767961521235",
"66307522437024110800864266951004654648",
"84356470515671063269944926416628685290",
"317654504538636784417338848810879488225"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@178e5657c8fd285125cc6743a81b513bce099760",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-4be5edfc",
"target": {
"function": "mhi_gen_tre",
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Function",
"digest": {
"length": 1116.0,
"function_hash": "240752375936065141592008159814999268736"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@899d0353ea69681f474b6bc9de32c663b89672da",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-768526bd",
"target": {
"function": "mhi_gen_tre",
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "313150500143964393621208542251292422495"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f084993c90d9d0b4a52a349ede5120f992a7ca1",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-e94b0920",
"target": {
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222574974953383264005877797053052386709",
"138253156854892865874529209275773548712",
"276120025014635244053667853540368839648",
"89989593375907120993299198071509580957",
"190029770412086532925588174041361257345",
"172316240001217717729027908398793680534",
"321940102515040812487759695957378045808",
"172880770372238853955178516225426286088",
"138561414629303262103521737738559383191",
"328254823487141607561714741081887997203",
"183546667564152096459925091973790552554",
"258715187216143011850746782849750065037",
"81280218609949641830785260431254955075",
"254320073461186772991849695767961521235",
"66307522437024110800864266951004654648",
"84356470515671063269944926416628685290",
"317654504538636784417338848810879488225"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a77955f7704b2a00385e232cbcc1cb06b5c7a425",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-ef3e6845",
"target": {
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"222574974953383264005877797053052386709",
"138253156854892865874529209275773548712",
"276120025014635244053667853540368839648",
"89989593375907120993299198071509580957",
"190029770412086532925588174041361257345",
"172316240001217717729027908398793680534",
"321940102515040812487759695957378045808",
"172880770372238853955178516225426286088",
"138561414629303262103521737738559383191",
"328254823487141607561714741081887997203",
"183546667564152096459925091973790552554",
"258715187216143011850746782849750065037",
"76105695026484211552944550550222938940",
"254320073461186772991849695767961521235",
"66307522437024110800864266951004654648",
"84356470515671063269944926416628685290",
"317654504538636784417338848810879488225"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a77955f7704b2a00385e232cbcc1cb06b5c7a425",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-23151-ffec9664",
"target": {
"function": "mhi_gen_tre",
"file": "drivers/bus/mhi/host/main.c"
},
"signature_type": "Function",
"digest": {
"length": 1116.0,
"function_hash": "240752375936065141592008159814999268736"
}
}
]