CVE-2025-39790 (GCVE-0-2025-39790)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-10-15 22:02
VLAI
Title
bus: mhi: host: Detect events pointing to unexpected TREs
Summary
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:54 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6843 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 , < 7b3f0e3b60c27f4fcb69927d84987e5fd6240530 (git)
Affected: 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 , < 4079c6c59705b96285219b9efc63cab870d757b7 (git)
Affected: 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 , < 5e17429679a8545afe438ce7a82a13a54e8ceabb (git)
Affected: 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 , < 2ec99b922f4661521927eeada76f431eebfbabc4 (git)
Affected: 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 , < 44e1a079e18f78d6594a715b0c6d7e18c656f7b9 (git)
Affected: 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 , < 5bd398e20f0833ae8a1267d4f343591a2dd20185 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.149 , ≤ 6.1.* (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.44 , ≤ 6.12.* (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:24.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:03.166Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39790",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:54:07.606490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:31.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bus/mhi/host/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b3f0e3b60c27f4fcb69927d84987e5fd6240530",
              "status": "affected",
              "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
              "versionType": "git"
            },
            {
              "lessThan": "4079c6c59705b96285219b9efc63cab870d757b7",
              "status": "affected",
              "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
              "versionType": "git"
            },
            {
              "lessThan": "5e17429679a8545afe438ce7a82a13a54e8ceabb",
              "status": "affected",
              "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
              "versionType": "git"
            },
            {
              "lessThan": "2ec99b922f4661521927eeada76f431eebfbabc4",
              "status": "affected",
              "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
              "versionType": "git"
            },
            {
              "lessThan": "44e1a079e18f78d6594a715b0c6d7e18c656f7b9",
              "status": "affected",
              "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
              "versionType": "git"
            },
            {
              "lessThan": "5bd398e20f0833ae8a1267d4f343591a2dd20185",
              "status": "affected",
              "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bus/mhi/host/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Detect events pointing to unexpected TREs\n\nWhen a remote device sends a completion event to the host, it contains a\npointer to the consumed TRE. The host uses this pointer to process all of\nthe TREs between it and the host\u0027s local copy of the ring\u0027s read pointer.\nThis works when processing completion for chained transactions, but can\nlead to nasty results if the device sends an event for a single-element\ntransaction with a read pointer that is multiple elements ahead of the\nhost\u0027s read pointer.\n\nFor instance, if the host accesses an event ring while the device is\nupdating it, the pointer inside of the event might still point to an old\nTRE. If the host uses the channel\u0027s xfer_cb() to directly free the buffer\npointed to by the TRE, the buffer will be double-freed.\n\nThis behavior was observed on an ep that used upstream EP stack without\n\u0027commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer\nis written\")\u0027. Where the device updated the events ring pointer before\nupdating the event contents, so it left a window where the host was able to\naccess the stale data the event pointed to, before the device had the\nchance to update them. The usual pattern was that the host received an\nevent pointing to a TRE that is not immediately after the last processed\none, so it got treated as if it was a chained transaction, processing all\nof the TREs in between the two read pointers.\n\nThis commit aims to harden the host by ensuring transactions where the\nevent points to a TRE that isn\u0027t local_rp + 1 are chained.\n\n[mani: added stable tag and reworded commit message]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed completion event is delivered by the MHI PCIe endpoint (WWAN modem, ath11k/ath12k WiFi card, qaic accelerator) into host DMA memory and consumed by the MSI tasklet, so the attacker must occupy the local device/bus position rather than a network one. This matches the established scoring for host drivers that trust device-supplied ring data (t7xx, virtio, hwrng).\nAC:L - An attacker controlling the endpoint simply writes an EOT event whose TRE pointer is not local_rp + 1 \u2014 a deterministic, repeatable protocol action requiring no race win or particular memory layout. The bug also fires spontaneously with endpoint firmware that updates the event read pointer before the payload.\nPR:N - No host account, capability, or authentication is involved; the event ring is processed automatically in the interrupt tasklet as soon as the MHI channels are enabled. There is no privilege gate anywhere on the mhi_irq_handler \u2192 mhi_ev_task \u2192 parse_xfer_event path.\nUI:N - Event processing is driven entirely by the device\u0027s MSI and requires no victim action once the MHI device is bound and channels are running. Data-path traffic on a modem or WiFi link generates these completions continuously.\nS:U - The double-free and stale-buffer use corrupt kernel heap objects belonging to the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed. Standard kernel-level memory corruption is Unchanged.\nC:H - The loop hands stale buf_info-\u003ecb_buf pointers with a device-chosen bytes_xferd to xfer_cb, so mhi_net_dl_callback does skb_put() on buffers the device never wrote and pushes uninitialized kernel memory into the network stack, and the resulting double-free/UAF yields a general heap read primitive.\nI:H - Double-freeing skbs and dma_unmap\u0027ing already-unmapped or still-in-flight buffers gives a classic heap-corruption primitive that can be groomed into an arbitrary write and control-flow hijack in kernel context. Buffers still owned by the device are also released back to the allocator while the endpoint may still DMA into them.\nA:H - The immediate observed effect is a double free, which trips slab corruption BUG()/panic, alongside DMA-API unmap warnings and use of freed skbs \u2014 a reliable kernel crash. It can be triggered repeatedly by the endpoint."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:10.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b3f0e3b60c27f4fcb69927d84987e5fd6240530"
        },
        {
          "url": "https://git.kernel.org/stable/c/4079c6c59705b96285219b9efc63cab870d757b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e17429679a8545afe438ce7a82a13a54e8ceabb"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ec99b922f4661521927eeada76f431eebfbabc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/44e1a079e18f78d6594a715b0c6d7e18c656f7b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bd398e20f0833ae8a1267d4f343591a2dd20185"
        }
      ],
      "title": "bus: mhi: host: Detect events pointing to unexpected TREs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39790",
    "datePublished": "2025-09-11T16:56:38.643Z",
    "dateReserved": "2025-04-16T07:20:57.131Z",
    "dateUpdated": "2026-10-15T22:02:31.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39790",
      "date": "2026-10-21",
      "epss": "0.00161",
      "percentile": "0.04931"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:41:47.000Z",
      "cve": "CVE-2025-39790",
      "id": "msrc_CVE-2025-39790",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bus: mhi: host: Detect events pointing to unexpected TREs",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39790.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bus/mhi/host/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7b3f0e3b60c27f4fcb69927d84987e5fd6240530",
                    "status": "affected",
                    "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4079c6c59705b96285219b9efc63cab870d757b7",
                    "status": "affected",
                    "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e17429679a8545afe438ce7a82a13a54e8ceabb",
                    "status": "affected",
                    "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2ec99b922f4661521927eeada76f431eebfbabc4",
                    "status": "affected",
                    "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "44e1a079e18f78d6594a715b0c6d7e18c656f7b9",
                    "status": "affected",
                    "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5bd398e20f0833ae8a1267d4f343591a2dd20185",
                    "status": "affected",
                    "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bus/mhi/host/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.7"
                  },
                  {
                    "lessThan": "5.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.190",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.149",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC CN 4100",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V5.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "18E45FF0-EBBB-4C43-9BC9-82B1394B7E56",
                    "versionEndExcluding": "5.15.190",
                    "versionStartIncluding": "5.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8",
                    "versionEndExcluding": "6.1.149",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48",
                    "versionEndExcluding": "6.6.103",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B",
                    "versionEndExcluding": "6.12.44",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D",
                    "versionEndExcluding": "6.16.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Detect events pointing to unexpected TREs\n\nWhen a remote device sends a completion event to the host, it contains a\npointer to the consumed TRE. The host uses this pointer to process all of\nthe TREs between it and the host\u0027s local copy of the ring\u0027s read pointer.\nThis works when processing completion for chained transactions, but can\nlead to nasty results if the device sends an event for a single-element\ntransaction with a read pointer that is multiple elements ahead of the\nhost\u0027s read pointer.\n\nFor instance, if the host accesses an event ring while the device is\nupdating it, the pointer inside of the event might still point to an old\nTRE. If the host uses the channel\u0027s xfer_cb() to directly free the buffer\npointed to by the TRE, the buffer will be double-freed.\n\nThis behavior was observed on an ep that used upstream EP stack without\n\u0027commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer\nis written\")\u0027. Where the device updated the events ring pointer before\nupdating the event contents, so it left a window where the host was able to\naccess the stale data the event pointed to, before the device had the\nchance to update them. The usual pattern was that the host received an\nevent pointing to a TRE that is not immediately after the last processed\none, so it got treated as if it was a chained transaction, processing all\nof the TREs in between the two read pointers.\n\nThis commit aims to harden the host by ensuring transactions where the\nevent points to a TRE that isn\u0027t local_rp + 1 are chained.\n\n[mani: added stable tag and reworded commit message]"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbus: mhi: host: Detectar eventos que apuntan a TREs inesperados\n\nCuando un dispositivo remoto env\u00eda un evento de completado al host, este contiene un puntero al TRE consumido. El host usa este puntero para procesar todos los TREs entre este y la copia local del host del puntero de lectura del anillo. Esto funciona al procesar la completaci\u00f3n para transacciones encadenadas, pero puede llevar a resultados desagradables si el dispositivo env\u00eda un evento para una transacci\u00f3n de un solo elemento con un puntero de lectura que est\u00e1 m\u00faltiples elementos por delante del puntero de lectura del host.\n\nPor ejemplo, si el host accede a un anillo de eventos mientras el dispositivo lo est\u00e1 actualizando, el puntero dentro del evento podr\u00eda seguir apuntando a un TRE antiguo. Si el host usa el xfer_cb() del canal para liberar directamente el b\u00fafer apuntado por el TRE, el b\u00fafer ser\u00e1 liberado dos veces.\n\nEste comportamiento fue observado en un ep que usaba la pila EP ascendente sin el \u0027commit 6f18d174b73d (\u201cbus: mhi: ep: Actualizar puntero de lectura solo despu\u00e9s de que el b\u00fafer sea escrito\u201d)\u0027. Donde el dispositivo actualiz\u00f3 el puntero del anillo de eventos antes de actualizar el contenido del evento, por lo que dej\u00f3 una ventana donde el host pudo acceder a los datos obsoletos a los que apuntaba el evento, antes de que el dispositivo tuviera la oportunidad de actualizarlos. El patr\u00f3n usual era que el host recib\u00eda un evento apuntando a un TRE que no est\u00e1 inmediatamente despu\u00e9s del \u00faltimo procesado, por lo que fue tratado como si fuera una transacci\u00f3n encadenada, procesando todos los TREs entre los dos punteros de lectura.\n\nEste commit tiene como objetivo fortalecer el host asegurando que las transacciones donde el evento apunta a un TRE que no es local_rp + 1 est\u00e9n encadenadas.\n\n[mani: se a\u00f1adi\u00f3 la etiqueta stable y se reescribi\u00f3 el mensaje del commit]"
          }
        ],
        "id": "CVE-2025-39790",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-39790",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:54:07.606490Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-11T17:15:45.360",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2ec99b922f4661521927eeada76f431eebfbabc4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4079c6c59705b96285219b9efc63cab870d757b7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/44e1a079e18f78d6594a715b0c6d7e18c656f7b9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5bd398e20f0833ae8a1267d4f343591a2dd20185"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5e17429679a8545afe438ce7a82a13a54e8ceabb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7b3f0e3b60c27f4fcb69927d84987e5fd6240530"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:58:08+00:00",
      "cve": "CVE-2025-39790",
      "id": "CVE-2025-39790",
      "initial_release_date": "2025-09-11T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bus: mhi: host: Detect events pointing to unexpected TREs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39790.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-16T12:54:43Z",
      "cve": "CVE-2025-39790",
      "id": "CVE-2025-39790",
      "initial_release_date": "2025-09-12T23:23:28Z",
      "product_status:known_affected": "346",
      "product_status:known_not_affected": "259",
      "product_status:recommended": "701",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39790",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2025/cve-2025-39790.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T17:43:24.145Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC CN 4100",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V5.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-12T12:07:03.166Z",
              "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
              "shortName": "siemens-SADP"
            },
            "references": [
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
              }
            ],
            "x_adpType": "supplier"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-39790",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T21:54:07.606490Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T21:54:08.679Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/bus/mhi/host/main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "7b3f0e3b60c27f4fcb69927d84987e5fd6240530",
                  "status": "affected",
                  "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                  "versionType": "git"
                },
                {
                  "lessThan": "4079c6c59705b96285219b9efc63cab870d757b7",
                  "status": "affected",
                  "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                  "versionType": "git"
                },
                {
                  "lessThan": "5e17429679a8545afe438ce7a82a13a54e8ceabb",
                  "status": "affected",
                  "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                  "versionType": "git"
                },
                {
                  "lessThan": "2ec99b922f4661521927eeada76f431eebfbabc4",
                  "status": "affected",
                  "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                  "versionType": "git"
                },
                {
                  "lessThan": "44e1a079e18f78d6594a715b0c6d7e18c656f7b9",
                  "status": "affected",
                  "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                  "versionType": "git"
                },
                {
                  "lessThan": "5bd398e20f0833ae8a1267d4f343591a2dd20185",
                  "status": "affected",
                  "version": "1d3173a3bae7039b765a0956e3e4bf846dbaacb8",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/bus/mhi/host/main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.7"
                },
                {
                  "lessThan": "5.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.190",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.149",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.103",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.44",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.16.*",
                  "status": "unaffected",
                  "version": "6.16.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.190",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.149",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.103",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.44",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.16.4",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Detect events pointing to unexpected TREs\n\nWhen a remote device sends a completion event to the host, it contains a\npointer to the consumed TRE. The host uses this pointer to process all of\nthe TREs between it and the host\u0027s local copy of the ring\u0027s read pointer.\nThis works when processing completion for chained transactions, but can\nlead to nasty results if the device sends an event for a single-element\ntransaction with a read pointer that is multiple elements ahead of the\nhost\u0027s read pointer.\n\nFor instance, if the host accesses an event ring while the device is\nupdating it, the pointer inside of the event might still point to an old\nTRE. If the host uses the channel\u0027s xfer_cb() to directly free the buffer\npointed to by the TRE, the buffer will be double-freed.\n\nThis behavior was observed on an ep that used upstream EP stack without\n\u0027commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer\nis written\")\u0027. Where the device updated the events ring pointer before\nupdating the event contents, so it left a window where the host was able to\naccess the stale data the event pointed to, before the device had the\nchance to update them. The usual pattern was that the host received an\nevent pointing to a TRE that is not immediately after the last processed\none, so it got treated as if it was a chained transaction, processing all\nof the TREs in between the two read pointers.\n\nThis commit aims to harden the host by ensuring transactions where the\nevent points to a TRE that isn\u0027t local_rp + 1 are chained.\n\n[mani: added stable tag and reworded commit message]"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The malformed completion event is delivered by the MHI PCIe endpoint (WWAN modem, ath11k/ath12k WiFi card, qaic accelerator) into host DMA memory and consumed by the MSI tasklet, so the attacker must occupy the local device/bus position rather than a network one. This matches the established scoring for host drivers that trust device-supplied ring data (t7xx, virtio, hwrng).\nAC:L - An attacker controlling the endpoint simply writes an EOT event whose TRE pointer is not local_rp + 1 \u2014 a deterministic, repeatable protocol action requiring no race win or particular memory layout. The bug also fires spontaneously with endpoint firmware that updates the event read pointer before the payload.\nPR:N - No host account, capability, or authentication is involved; the event ring is processed automatically in the interrupt tasklet as soon as the MHI channels are enabled. There is no privilege gate anywhere on the mhi_irq_handler \u2192 mhi_ev_task \u2192 parse_xfer_event path.\nUI:N - Event processing is driven entirely by the device\u0027s MSI and requires no victim action once the MHI device is bound and channels are running. Data-path traffic on a modem or WiFi link generates these completions continuously.\nS:U - The double-free and stale-buffer use corrupt kernel heap objects belonging to the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed. Standard kernel-level memory corruption is Unchanged.\nC:H - The loop hands stale buf_info-\u003ecb_buf pointers with a device-chosen bytes_xferd to xfer_cb, so mhi_net_dl_callback does skb_put() on buffers the device never wrote and pushes uninitialized kernel memory into the network stack, and the resulting double-free/UAF yields a general heap read primitive.\nI:H - Double-freeing skbs and dma_unmap\u0027ing already-unmapped or still-in-flight buffers gives a classic heap-corruption primitive that can be groomed into an arbitrary write and control-flow hijack in kernel context. Buffers still owned by the device are also released back to the allocator while the endpoint may still DMA into them.\nA:H - The immediate observed effect is a double free, which trips slab corruption BUG()/panic, alongside DMA-API unmap warnings and use of freed skbs \u2014 a reliable kernel crash. It can be triggered repeatedly by the endpoint."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:05:10.802Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/7b3f0e3b60c27f4fcb69927d84987e5fd6240530"
            },
            {
              "url": "https://git.kernel.org/stable/c/4079c6c59705b96285219b9efc63cab870d757b7"
            },
            {
              "url": "https://git.kernel.org/stable/c/5e17429679a8545afe438ce7a82a13a54e8ceabb"
            },
            {
              "url": "https://git.kernel.org/stable/c/2ec99b922f4661521927eeada76f431eebfbabc4"
            },
            {
              "url": "https://git.kernel.org/stable/c/44e1a079e18f78d6594a715b0c6d7e18c656f7b9"
            },
            {
              "url": "https://git.kernel.org/stable/c/5bd398e20f0833ae8a1267d4f343591a2dd20185"
            }
          ],
          "title": "bus: mhi: host: Detect events pointing to unexpected TREs",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-39790",
        "datePublished": "2025-09-11T16:56:38.643Z",
        "dateReserved": "2025-04-16T07:20:57.131Z",
        "dateUpdated": "2026-10-15T22:02:31.777Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.