CVE-2025-23151

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bus: mhi: host: Fix race between unprepare and queue_buf<br /> <br /> A client driver may use mhi_unprepare_from_transfer() to quiesce<br /> incoming data during the client driver&amp;#39;s tear down. The client driver<br /> might also be processing data at the same time, resulting in a call to<br /> mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs<br /> after mhi_unprepare_from_transfer() has torn down the channel, a panic<br /> will occur due to an invalid dereference leading to a page fault.<br /> <br /> This occurs because mhi_gen_tre() does not verify the channel state<br /> after locking it. Fix this by having mhi_gen_tre() confirm the channel<br /> state is valid, or return error to avoid accessing deinitialized data.<br /> <br /> [mani: added stable tag]