high 8.4

CVE-2025-39790 json

bus: mhi: host: Detect events pointing to unexpected TREs

published 2025-09-11 13 mo ago modified 2026-10-19 20 d ago also EUVD-2025-28923

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer.

For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed.

This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers.

This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained.

[mani: added stable tag and reworded commit message]

Patch / fix

fixed in 2 distros 4 links 6

Linux Linux 5.15.190, 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17
Siemens SIMATIC CN 4100 V5.0

debian ubuntu suse opensuse

linux Debian 12 6.1.153-1
linux Debian 13 6.12.48-1
linux Debian 14 6.16.5-1

debian advisories DEBIAN-CVE-2025-39790

linux Ubuntu 22.04 LTS 5.15.0-163.173
linux Ubuntu 24.04 LTS 6.8.0-100.100
linux-aws Ubuntu 22.04 LTS 5.15.0-1097.104
linux-aws Ubuntu 24.04 LTS 6.8.0-1046.49
linux-gcp Ubuntu 22.04 LTS 5.15.0-1097.106
linux-gcp Ubuntu 24.04 LTS 6.8.0-1047.50
linux-gke Ubuntu 22.04 LTS 5.15.0-1093.99
linux-gke Ubuntu 24.04 LTS 6.8.0-1043.48

ubuntu advisories UBUNTU-CVE-2025-39790

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt Linux Micro 6.2 6.12.0-160000.6.1
kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.6.1
kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1.160000.2.4
kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
kernel-kvmsmall SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1

suse advisories SUSE-SU-2025:21074-1 SUSE-SU-2025:21139-1 SUSE-SU-2026:20560-1 SUSE-SU-2025:21179-1 SUSE-SU-2025:4141-1 SUSE-SU-2025:4132-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1

opensuse advisories openSUSE-SU-2025:20081-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-39790 updated 2026-11-05 cvss 6.7

kernel: bus: mhi: host: Detect events pointing to unexpected TREs

Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: no fix available “Fix deferred”
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-134-10 updated 2026-05-14 cvss 6.7

Siemens SIMATIC

Siemens SIMATIC CN 4100 < 5.0
affected: fixed in V5.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 24 d ago (2026-10-15)

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux
Siemens SIMATIC CN 4100

Classification

Weakness

CWE-415 Double Free

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2025-39790
NVD CVE-2025-39790

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary