CVE-2025-39790

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: host: Detect events pointing to unexpected TREs

When a remote device sends a completion event to the host, it contains a

pointer to the consumed TRE. The host uses this pointer to process all of

the TREs between it and the host's local copy of the ring's read pointer.

This works when processing completion for chained transactions, but can

lead to nasty results if the device sends an event for a single-element

transaction with a read pointer that is multiple elements ahead of the

host's read pointer.

For instance, if the host accesses an event ring while the device is

updating it, the pointer inside of the event might still point to an old

TRE. If the host uses the channel's xfer_cb() to directly free the buffer

pointed to by the TRE, the buffer will be double-freed.

This behavior was observed on an ep that used upstream EP stack without

'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after b

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References