In the Linux kernel, the following vulnerability has been resolved:
bus: mhi: host: Detect events pointing to unexpected TREs
When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer.
For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed.
This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers.
This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained.
[mani: added stable tag and reworded commit message]
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Sep 25, 2025 | Sep 25, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 11, 2025 | Sep 11, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 11, 2025 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade dtb-broadcomUpgrade kernel-macrosUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-extraUpgrade kernel-debug-develUpgrade kernel-default-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-64kb-extraUpgrade kernel-docs-htmlUpgrade kernel-symsUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-optionalUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-docsUpgrade dtb-amdUpgrade dtb-renesasUpgrade kernel-defaultUpgrade kernel-default-extraUpgrade dtb-amlogicUpgrade dtb-socionextUpgrade kernel-default-baseUpgrade kernel-rt_debugUpgrade dtb-sprdUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-syms-rtUpgrade dtb-nvidiaUpgrade reiserfs-kmp-64kbUpgrade kernel-obs-qaUpgrade dtb-apmUpgrade dtb-appleUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmallUpgrade dtb-armUpgrade dtb-hisiliconUpgrade dtb-marvellUpgrade kernel-default-develUpgrade kernel-azure-optionalUpgrade dtb-exynosUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade dtb-lgUpgrade dtb-caviumUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmall-develUpgrade kernel-devel-rtUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade kernel-azureUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-zfcpdumpUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade kernel-default-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-default-optionalUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade ocfs2-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-debug-vdsoUpgrade dtb-xilinxUpgrade kernel-debugUpgrade dtb-freescaleUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade kernel-obs-buildUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade dtb-alteraUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-rtUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade dtb-qcom | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-gcp-6.8Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-fipsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-genericUpgrade linux-image-aws-64k-5.15Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracleUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-generic-64k-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-5.15Upgrade linux-image-generic-lpaeUpgrade linux-image-gkeop-6.8Upgrade linux-image-ibm-5.15Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-awsUpgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-oem-20.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidiaUpgrade linux-image-lowlatency-5.15Upgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-ibm-6.8Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-ibmUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-gcp-5.15Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-fips-5.15Upgrade linux-image-azure-fips-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-aws-5.15Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-virtualUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-aws-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-oem-20.04dUpgrade linux-image-gcpUpgrade linux-image-azure-lts-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-kvmUpgrade linux-image-gke-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-raspi-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-oem-20.04cUpgrade linux-image-intelUpgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-azureUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-xilinxUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-5.15Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-fips-6.8Upgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-generic-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-azure-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-5.15.0-163-fipsUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-realtime-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-intel-iotgUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-raspiUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-163-genericUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64k-5.15Upgrade linux-image-generic-64kUpgrade linux-image-aws-fips-5.15Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-oracle-64kUpgrade linux-image-kvm-5.15Upgrade linux-image-5.15.0-1102-azureUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-azure-5.15Upgrade linux-image-azure-fipsUpgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-virtual-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-gkeopUpgrade linux-image-gke-6.8Upgrade linux-image-5.15.0-1101-azureUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-5.15.0-1097-awsUpgrade linux-image-5.15.0-1049-nvidia-tegra-rtUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-raspi-5.15Upgrade linux-image-oracle-5.15Upgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-6.8 | Dec 5, 2025 | Sep 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | Sep 11, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub