---
id: CVE-2025-23151
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bus: mhi: host: Fix race between unprepare and queue_buf

  A client driver may use mhi_unprepare_from_transfer() to quiesce
  incoming data during the client driver's tear…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bus: mhi: host: Fix race between unprepare and queue_buf

  A client driver may use mhi_unprepare_from_transfer() to quiesce
  incoming data during the client driver's tear…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-362
  - CWE-366
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.15.149, < 5.15.181'
  - 'linux_kernel >= 6.1.76, < 6.1.135'
  - 'linux_kernel >= 6.6.15, < 6.6.88'
  - 'linux_kernel >= 6.7.3, < 6.12.24'
  - 'linux_kernel >= 6.13, < 6.13.12'
  - 'linux_kernel >= 6.14, < 6.14.3'
  - debian_linux = 11.0
patched:
  - linux_kernel 6.14.3
published: '2025-05-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:16.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-23151'
references:
  - url: 'https://git.kernel.org/stable/c/0686a818d77a431fc3ba2fab4b46bbb04e8c9380'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/178e5657c8fd285125cc6743a81b513bce099760'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3e7ecf181cbdde9753204ada3883ca1704d8702b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5f084993c90d9d0b4a52a349ede5120f992a7ca1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/899d0353ea69681f474b6bc9de32c663b89672da'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a77955f7704b2a00385e232cbcc1cb06b5c7a425'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee1fce83ed56450087309b9b74ad9bcb2b010fa6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-23151.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-23151'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2363342'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-23151'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-23151'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025050128-CVE-2025-23151-aba7@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00155
epssPercentile: 0.04527
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:44:50.471969Z'
scores:
  nvd: 7.8
  vendor: 4.1
  cna: 7.8
ingestedAt: '2026-10-15T22:48:25.476Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: host: Fix race between unprepare and queue_buf

A client driver may use mhi_unprepare_from_transfer() to quiesce
incoming data during the client driver's tear down. The client driver
might also be processing data at the same time, resulting in a call to
mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs
after mhi_unprepare_from_transfer() has torn down the channel, a panic
will occur due to an invalid dereference leading to a page fault.

This occurs because mhi_gen_tre() does not verify the channel state
after locking it. Fix this by having mhi_gen_tre() confirm the channel
state is valid, or return error to avoid accessing deinitialized data.

[mani: added stable tag]

## Affected

- `linux_kernel >= 5.15.149, < 5.15.181`
- `linux_kernel >= 6.1.76, < 6.1.135`
- `linux_kernel >= 6.6.15, < 6.6.88`
- `linux_kernel >= 6.7.3, < 6.12.24`
- `linux_kernel >= 6.13, < 6.13.12`
- `linux_kernel >= 6.14, < 6.14.3`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.14.3`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-23151.json)