Description
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag]
Product status
176ed1727badd2fad2158e2b214dcbc24f4be7a1 (git) before 899d0353ea69681f474b6bc9de32c663b89672da
0b093176fd0967a5f56e2c86b0d48247f6c0fa0f (git) before 3e7ecf181cbdde9753204ada3883ca1704d8702b
ce16274a6b8d1483d0d8383272deb2bfd1b577ca (git) before 5f084993c90d9d0b4a52a349ede5120f992a7ca1
b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 (git) before a77955f7704b2a00385e232cbcc1cb06b5c7a425
b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 (git) before 178e5657c8fd285125cc6743a81b513bce099760
b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 (git) before ee1fce83ed56450087309b9b74ad9bcb2b010fa6
b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 (git) before 0686a818d77a431fc3ba2fab4b46bbb04e8c9380
642adb03541673f3897f64bbb62856ffd73807f5 (git)
5.15.149 (semver) before 5.15.181
6.1.76 (semver) before 6.1.135
6.6.15 (semver) before 6.6.88
6.7.3 (semver) before 6.8
6.8
Any version before 6.8
5.15.181 (semver)
6.1.135 (semver)
6.6.88 (semver)
6.12.24 (semver)
6.13.12 (semver)
6.14.3 (semver)
6.15 (original_commit_for_fix)
References
lists.debian.org/debian-lts-announce/2025/05/msg00045.html
git.kernel.org/...c/899d0353ea69681f474b6bc9de32c663b89672da
git.kernel.org/...c/3e7ecf181cbdde9753204ada3883ca1704d8702b
git.kernel.org/...c/5f084993c90d9d0b4a52a349ede5120f992a7ca1
git.kernel.org/...c/a77955f7704b2a00385e232cbcc1cb06b5c7a425
git.kernel.org/...c/178e5657c8fd285125cc6743a81b513bce099760
git.kernel.org/...c/ee1fce83ed56450087309b9b74ad9bcb2b010fa6
git.kernel.org/...c/0686a818d77a431fc3ba2fab4b46bbb04e8c9380