{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39790","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.131Z","datePublished":"2025-09-11T16:56:38.643Z","dateUpdated":"2026-08-05T12:05:10.802Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:05:10.802Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Detect events pointing to unexpected TREs\n\nWhen a remote device sends a completion event to the host, it contains a\npointer to the consumed TRE. The host uses this pointer to process all of\nthe TREs between it and the host's local copy of the ring's read pointer.\nThis works when processing completion for chained transactions, but can\nlead to nasty results if the device sends an event for a single-element\ntransaction with a read pointer that is multiple elements ahead of the\nhost's read pointer.\n\nFor instance, if the host accesses an event ring while the device is\nupdating it, the pointer inside of the event might still point to an old\nTRE. If the host uses the channel's xfer_cb() to directly free the buffer\npointed to by the TRE, the buffer will be double-freed.\n\nThis behavior was observed on an ep that used upstream EP stack without\n'commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer\nis written\")'. Where the device updated the events ring pointer before\nupdating the event contents, so it left a window where the host was able to\naccess the stale data the event pointed to, before the device had the\nchance to update them. The usual pattern was that the host received an\nevent pointing to a TRE that is not immediately after the last processed\none, so it got treated as if it was a chained transaction, processing all\nof the TREs in between the two read pointers.\n\nThis commit aims to harden the host by ensuring transactions where the\nevent points to a TRE that isn't local_rp + 1 are chained.\n\n[mani: added stable tag and reworded commit message]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The malformed completion event is delivered by the MHI PCIe endpoint (WWAN modem, ath11k/ath12k WiFi card, qaic accelerator) into host DMA memory and consumed by the MSI tasklet, so the attacker must occupy the local device/bus position rather than a network one. This matches the established scoring for host drivers that trust device-supplied ring data (t7xx, virtio, hwrng).\nAC:L - An attacker controlling the endpoint simply writes an EOT event whose TRE pointer is not local_rp + 1 — a deterministic, repeatable protocol action requiring no race win or particular memory layout. The bug also fires spontaneously with endpoint firmware that updates the event read pointer before the payload.\nPR:N - No host account, capability, or authentication is involved; the event ring is processed automatically in the interrupt tasklet as soon as the MHI channels are enabled. There is no privilege gate anywhere on the mhi_irq_handler → mhi_ev_task → parse_xfer_event path.\nUI:N - Event processing is driven entirely by the device's MSI and requires no victim action once the MHI device is bound and channels are running. Data-path traffic on a modem or WiFi link generates these completions continuously.\nS:U - The double-free and stale-buffer use corrupt kernel heap objects belonging to the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed. Standard kernel-level memory corruption is Unchanged.\nC:H - The loop hands stale buf_info->cb_buf pointers with a device-chosen bytes_xferd to xfer_cb, so mhi_net_dl_callback does skb_put() on buffers the device never wrote and pushes uninitialized kernel memory into the network stack, and the resulting double-free/UAF yields a general heap read primitive.\nI:H - Double-freeing skbs and dma_unmap'ing already-unmapped or still-in-flight buffers gives a classic heap-corruption primitive that can be groomed into an arbitrary write and control-flow hijack in kernel context. Buffers still owned by the device are also released back to the allocator while the endpoint may still DMA into them.\nA:H - The immediate observed effect is a double free, which trips slab corruption BUG()/panic, alongside DMA-API unmap warnings and use of freed skbs — a reliable kernel crash. It can be triggered repeatedly by the endpoint."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bus/mhi/host/main.c"],"versions":[{"version":"1d3173a3bae7039b765a0956e3e4bf846dbaacb8","lessThan":"7b3f0e3b60c27f4fcb69927d84987e5fd6240530","status":"affected","versionType":"git"},{"version":"1d3173a3bae7039b765a0956e3e4bf846dbaacb8","lessThan":"4079c6c59705b96285219b9efc63cab870d757b7","status":"affected","versionType":"git"},{"version":"1d3173a3bae7039b765a0956e3e4bf846dbaacb8","lessThan":"5e17429679a8545afe438ce7a82a13a54e8ceabb","status":"affected","versionType":"git"},{"version":"1d3173a3bae7039b765a0956e3e4bf846dbaacb8","lessThan":"2ec99b922f4661521927eeada76f431eebfbabc4","status":"affected","versionType":"git"},{"version":"1d3173a3bae7039b765a0956e3e4bf846dbaacb8","lessThan":"44e1a079e18f78d6594a715b0c6d7e18c656f7b9","status":"affected","versionType":"git"},{"version":"1d3173a3bae7039b765a0956e3e4bf846dbaacb8","lessThan":"5bd398e20f0833ae8a1267d4f343591a2dd20185","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bus/mhi/host/main.c"],"versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","status":"unaffected","versionType":"semver"},{"version":"5.15.190","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.149","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.103","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.44","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.4","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.15.190"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.6.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.12.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.16.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/7b3f0e3b60c27f4fcb69927d84987e5fd6240530"},{"url":"https://git.kernel.org/stable/c/4079c6c59705b96285219b9efc63cab870d757b7"},{"url":"https://git.kernel.org/stable/c/5e17429679a8545afe438ce7a82a13a54e8ceabb"},{"url":"https://git.kernel.org/stable/c/2ec99b922f4661521927eeada76f431eebfbabc4"},{"url":"https://git.kernel.org/stable/c/44e1a079e18f78d6594a715b0c6d7e18c656f7b9"},{"url":"https://git.kernel.org/stable/c/5bd398e20f0833ae8a1267d4f343591a2dd20185"}],"title":"bus: mhi: host: Detect events pointing to unexpected TREs","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:43:24.145Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:07:03.166Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}