linux-cve-announce - CVE-2025-38429: bus: mhi: ep: Update read pointer only after buffer is written

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072556-CVE-2025-38429-f662@gregkh>
Date: Fri, 25 Jul 2025 16:17:02 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38429: bus: mhi: ep: Update read pointer only after buffer is written

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Update read pointer only after buffer is written

Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated
before the buffer is written, potentially causing race conditions where
the host sees an updated read pointer before the buffer is actually
written. Updating rd_offset prematurely can lead to the host accessing
an uninitialized or incomplete element, resulting in data corruption.

Invoke the buffer write before updating rd_offset to ensure the element
is fully written before signaling its availability.

The Linux kernel CVE team has assigned CVE-2025-38429 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 and fixed in 6.6.95 with commit 44b9620e82bbec2b9a6ac77f63913636d84f96dc
	Issue introduced in 5.19 with commit bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 and fixed in 6.12.35 with commit f704a80d9fa268e51a6cc5242714502c3c1fa605
	Issue introduced in 5.19 with commit bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 and fixed in 6.15.4 with commit 0007ef098dab48f1ba58364c40b4809f1e21b130
	Issue introduced in 5.19 with commit bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 and fixed in 6.16-rc1 with commit 6f18d174b73d0ceeaa341f46c0986436b3aefc9a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38429
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/bus/mhi/ep/ring.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc
	https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605
	https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130
	https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a