Answer in brief
CVE-2025-23151 records a Unknown severity vulnerability in bus: mhi: host: Fix race between unprepare and queue_buf. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2025-23151 records a Unknown severity vulnerability in bus: mhi: host: Fix race between unprepare and queue_buf. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=176ed1727badd2fad2158e2b214dcbc24f4be7a1 <899d0353ea69681f474b6bc9de32c663b89672da || >=0b093176fd0967a5f56e2c86b0d48247f6c0fa0f <3e7ecf181cbdde9753204ada3883ca1704d8702b || >=ce16274a6b8d1483d0d8383272deb2bfd1b577ca <5f084993c90d9d0b4a52a349ede5120f992a7ca1 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <a77955f7704b2a00385e232cbcc1cb06b5c7a425 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <178e5657c8fd285125cc6743a81b513bce099760 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <ee1fce83ed56450087309b9b74ad9bcb2b010fa6 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <0686a818d77a431fc3ba2fab4b46bbb04e8c9380 || 642adb03541673f3897f64bbb62856ffd73807f5 || >=5.15.149 <5.15.181 || >=6.1.76 <6.1.135 || >=6.6.15 <6.6.88 || >=6.7.3 <6.8 | 899d0353ea69681f474b6bc9de32c663b89672da, 3e7ecf181cbdde9753204ada3883ca1704d8702b, 5f084993c90d9d0b4a52a349ede5120f992a7ca1, a77955f7704b2a00385e232cbcc1cb06b5c7a425, 178e5657c8fd285125cc6743a81b513bce099760, ee1fce83ed56450087309b9b74ad9bcb2b010fa6, 0686a818d77a431fc3ba2fab4b46bbb04e8c9380, 5.15.181, 6.1.135, 6.6.88, 6.8 |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
May 1, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag]
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=176ed1727badd2fad2158e2b214dcbc24f4be7a1 <899d0353ea69681f474b6bc9de32c663b89672da || >=0b093176fd0967a5f56e2c86b0d48247f6c0fa0f <3e7ecf181cbdde9753204ada3883ca1704d8702b || >=ce16274a6b8d1483d0d8383272deb2bfd1b577ca <5f084993c90d9d0b4a52a349ede5120f992a7ca1 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <a77955f7704b2a00385e232cbcc1cb06b5c7a425 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <178e5657c8fd285125cc6743a81b513bce099760 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <ee1fce83ed56450087309b9b74ad9bcb2b010fa6 || >=b89b6a863dd53bc70d8e52d50f9cfaef8ef5e9c9 <0686a818d77a431fc3ba2fab4b46bbb04e8c9380 || 642adb03541673f3897f64bbb62856ffd73807f5 || >=5.15.149 <5.15.181 || >=6.1.76 <6.1.135 || >=6.6.15 <6.6.88 || >=6.7.3 <6.8 | 899d0353ea69681f474b6bc9de32c663b89672da, 3e7ecf181cbdde9753204ada3883ca1704d8702b, 5f084993c90d9d0b4a52a349ede5120f992a7ca1, a77955f7704b2a00385e232cbcc1cb06b5c7a425, 178e5657c8fd285125cc6743a81b513bce099760, ee1fce83ed56450087309b9b74ad9bcb2b010fa6, 0686a818d77a431fc3ba2fab4b46bbb04e8c9380, 5.15.181, 6.1.135, 6.6.88, 6.8 |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
May 1, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag]
Quoted source text, attributed separately from HOL analysis.