---
id: CVE-2025-38429
title: 'bus: mhi: ep: Update read pointer only after buffer is written'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bus: mhi: ep: Update read pointer only after buffer is written

  Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated
  before the buffer is written, po…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 <
    e2176aa3ba4361e98d9f91178a762dca6cf21fe0
  - >-
    Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 <
    44b9620e82bbec2b9a6ac77f63913636d84f96dc
  - >-
    Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 <
    f704a80d9fa268e51a6cc5242714502c3c1fa605
  - >-
    Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 <
    0007ef098dab48f1ba58364c40b4809f1e21b130
  - >-
    Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 <
    6f18d174b73d0ceeaa341f46c0986436b3aefc9a
  - Linux 5.19
published: '2025-07-25'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:21:58.744Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38429'
references:
  - url: 'https://git.kernel.org/stable/c/e2176aa3ba4361e98d9f91178a762dca6cf21fe0'
  - url: 'https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc'
  - url: 'https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605'
  - url: 'https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130'
  - url: 'https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a'
tags:
  - cve.org
epss: 0.00465
epssPercentile: 0.40532
ingestedAt: '2026-11-03T18:52:04.084Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Update read pointer only after buffer is written

Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated
before the buffer is written, potentially causing race conditions where
the host sees an updated read pointer before the buffer is actually
written. Updating rd_offset prematurely can lead to the host accessing
an uninitialized or incomplete element, resulting in data corruption.

Invoke the buffer write before updating rd_offset to ensure the element
is fully written before signaling its availability.

## Affected

- `Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 < e2176aa3ba4361e98d9f91178a762dca6cf21fe0`
- `Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 < 44b9620e82bbec2b9a6ac77f63913636d84f96dc`
- `Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 < f704a80d9fa268e51a6cc5242714502c3c1fa605`
- `Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 < 0007ef098dab48f1ba58364c40b4809f1e21b130`
- `Linux >= bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34 < 6f18d174b73d0ceeaa341f46c0986436b3aefc9a`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.