LiveActive security incident?Get immediate response
CVE Record

CVE-2025-23151: bus: mhi: host: Fix race between unprepare and queue_buf

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag]

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A timing flaw in Linux's MHI host subsystem can cause the kernel to access already-deinitialized channel data while a client driver is shutting down. The documented result is a page fault and kernel panic, potentially interrupting the affected system. The CVSS score is 7.8 (High) and assumes local, low-privileged access rather than remote exploitation.

Executive priority

Treat this as high priority on MHI-enabled systems supporting critical services because successful triggering can panic the kernel. The vector is local and there is no cited active exploitation, so an emergency internet-wide response is unsupported. Patch during the next maintenance window after confirming exposure, accelerating where related crashes have occurred.

Technical view

A race exists between mhi_unprepare_from_transfer() tearing down a channel and mhi_queue_buf() reaching mhi_gen_tre(). The latter did not revalidate channel state after acquiring its lock and could dereference deinitialized data. The stable fix checks channel validity while locked and returns an error when the channel is no longer usable.

Likely exposure

Exposure is limited to Linux systems using the MHI host path with a vulnerable, unpatched kernel. The bundled version data mixes releases and commit identifiers, making exact status unclear. Confirm the running distribution kernel and applicable backports rather than relying solely on upstream version numbers.

Exploitation context

CVE-2025-23151 is not listed in KEV, and no cited source reports active exploitation. The CVSS vector describes a local, low-complexity, low-privilege condition requiring no user interaction. The documented outcome is a race-triggered kernel panic; the sources do not demonstrate a remote path or practical confidentiality and integrity compromise.

Researcher notes

The record supplies no CWE. Its CVSS vector rates confidentiality, integrity, and availability impacts as high, but the technical description specifically establishes only an invalid dereference, page fault, and panic. Treat broader data compromise as score-based rather than demonstrated. Exact affected and fixed releases require downstream vendor verification because the supplied version metadata is ambiguous.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable stable fix or backport.
  • Check distributor guidance for a supported temporary mitigation if immediate updating is impossible; the bundle names none.
  • Prioritize exposed MHI-enabled systems that support availability-critical workloads.
  • Monitor affected systems for kernel panics or page faults until remediation is complete.

Validation and detection

  • Inventory the exact running kernel build and distributor package, including backported patches.
  • Confirm whether the MHI host subsystem and relevant client drivers are present and actively used.
  • Verify the kernel source or vendor changelog includes the cited channel-state validation fix.
  • Review crash logs for MHI-related invalid dereferences during client-driver teardown.
  • Test driver shutdown and queued-data handling in a controlled environment after updating.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-23151 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-23151Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux176ed1727badd2fad2158e2b214dcbc24f4be7a1, 0b093176fd0967a5f56e2c86b0d48247f6c0fa0f, ce16274a6b8d1483d0d8383272deb2bfd1b577ca, b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9, b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9, b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9, b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9, 642adb03541673f3897f64bbb62856ffd73807f5, 5.15.149, 6.1.76, 6.6.15, 6.7.3unaffected
LinuxLinux6.8, 0, 5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.