LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38429: bus: mhi: ep: Update read pointer only after buffer is written

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after buffer is written Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element, resulting in data corruption. Invoke the buffer write before updating rd_offset to ensure the element is fully written before signaling its availability.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux MHI endpoint timing flaw can tell a connected host that data is ready before the data is fully written. The host may then consume incomplete or uninitialized information, causing corruption. The supplied rating is critical, but practical exposure depends on whether a system uses the affected MHI endpoint path.

Executive priority

Urgently inventory MHI-enabled Linux assets and schedule supported kernel updates. Prioritize systems where corruption could affect critical operations. A fleet-wide emergency response is not justified solely by the supplied evidence because active exploitation and broad reachability are unconfirmed.

Technical view

In mhi_ep_ring_add_element, rd_offset was advanced before the ring element buffer write completed. That ordering creates a race in which the host can observe availability and access an incomplete element. The upstream correction writes the buffer first and updates rd_offset afterward.

Likely exposure

Exposure appears limited to Linux systems exercising the MHI endpoint ring implementation. The bundle identifies affected Linux releases including 5.19, 6.6.95, 6.12.35, 6.15.4, and 6.16, but its version structure is ambiguous; confirm exact affected and fixed releases through Linux stable guidance.

Exploitation context

The supplied sources do not establish active exploitation, public weaponization, or inclusion in CISA KEV. The stated consequence is data corruption caused by a race condition. The CVSS 10 rating indicates severe theoretical impact, but the bundle does not demonstrate that ordinary network access alone reaches this kernel path.

Researcher notes

The central issue is publication ordering between the element write and rd_offset update. Review architecture-specific memory-ordering implications and backport equivalence when validating fixes. The bundle provides four stable commits but does not map each commit clearly to a release branch, and no CWE is supplied.

Mitigation direction

  • Identify systems using the Linux MHI endpoint functionality.
  • Upgrade to a vendor-supported kernel containing the applicable cited fix.
  • Check Linux distribution advisories for exact fixed package versions.
  • Prioritize exposed or operationally critical MHI-enabled systems.
  • Restrict untrusted access to affected device or host interfaces where feasible.

Validation and detection

  • Record running kernel versions on potentially MHI-enabled assets.
  • Confirm whether the MHI endpoint driver and affected ring path are used.
  • Compare kernel source or vendor packages against the cited fix commits.
  • Test relevant MHI communications for corruption after updating.
  • Verify the replacement kernel is active following reboot.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38429 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Linux

Vulnerability scoring details

Base CVSS 3.1 score

10Critical
CVSS 3.1 vector shape for CVE-2025-38429Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34, bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34, bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34, bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34unaffected
LinuxLinux5.19, 0, 6.6.95, 6.12.35, 6.15.4, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.