Skip to main content

Linux Kernel CVE-2025-38429

MEDIUM
Use of Uninitialized Resource (CWE-908)
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privilege shell
  2. Delivery
    Confirm MHI endpoint device present
  3. Exploit
    Trigger concurrent ring buffer writes via MHI endpoint interface
  4. Execution
    Win race between rd_offset update and buffer write
  5. Persist
    Host reads uninitialized ring element
  6. Impact
    Data corruption or kernel panic

Vulnerability Assessment

Weakness
CWE
CWE-908
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
Exploitation Conditions

Exploitation requires: (1) local system access with at least low-privilege credentials (PR:L per CVSS), (2) an MHI-capable PCIe endpoint device physically present and enumerated by the kernel - this driver path is inactive on systems without such hardware, (3) the mhi_ep kernel module loaded and in active use processing ring buffer operations. Exploitation is limited by the race timing window inherent to concurrent ring buffer access; reliable triggering may require specific workload conditions or repeated attempts. Systems without MHI endpoint hardware (the vast majority of general-purpose servers, desktops, and cloud VMs) are not affected regardless of kernel version.
Impact

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 Medium, reflecting local, low-privilege access and pure availability impact. However, the AC:L designation warrants scrutiny: race conditions typically require favorable timing windows, which conventionally maps to AC:H - the vendor may have assessed the race as reliably triggerable. EPSS is 0.15% at the 5th percentile, indicating very low community-assessed exploitation probability. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis. Real-world risk is further constrained by the requirement for MHI endpoint-mode hardware (PCIe-attached modem or compatible peripheral) to be present and active. This is a real kernel integrity concern for embedded/telecom platforms using MHI, but is not a broad enterprise priority given the hardware dependency, local access requirement, and negligible EPSS signal.
Exploit ScenarioDerived

A local attacker with standard user privileges on a system running an MHI endpoint-mode device (e.g., an embedded platform with a Qualcomm PCIe modem) triggers rapid, concurrent MHI ring buffer operations to win the race window between the rd_offset update and the buffer write. The host-side MHI controller reads the ring element before it is fully populated, consuming uninitialized or corrupt data, which may manifest as a kernel panic, silent data corruption in modem communications, or system instability. No public proof-of-concept is known at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Race condition in the Linux kernel's MHI (Mobile Host Interface) endpoint driver allows a local low-privileged user to trigger data corruption by exploiting a premature read pointer update in mhi_ep_ring_add_element. Specifically, rd_offset is advanced before the ring buffer element is fully written, allowing the remote host to read uninitialized or incomplete data from the MHI ring - resulting in data corruption and potential availability loss. No public exploit identified at time of analysis; four stable-branch patches are available at kernel.org.

RemediationAI

Apply the upstream fix by updating to a patched Linux kernel version containing one of the four stable-branch commits: 0007ef098dab48f1ba58364c40b4809f1e21b130, 44b9620e82bbec2b9a6ac77f63913636d84f96dc, 6f18d174b73d0ceeaa341f46c0986436b3aefc9a, or f704a80d9fa268e51a6cc5242714502c3c1fa605, all available at https://git.kernel.org/stable/. Distribution maintainers (e.g., RHEL, Ubuntu, Debian, SUSE) should be consulted for backport status to distribution kernels. If immediate kernel update is not feasible and MHI endpoint functionality is not required, unloading or blacklisting the mhi_ep kernel module (modprobe -r mhi_ep; echo 'blacklist mhi_ep' >> /etc/modprobe.d/blacklist.conf) eliminates the attack surface with no impact on unrelated system functions. If the MHI endpoint driver is required, restrict local system access to trusted users as a compensating control, noting this only raises the bar rather than eliminating the race.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

MHI (Mobile Host Interface) is a bus protocol defined by Qualcomm for PCIe-based host-to-modem (and similar peripheral) communication. The Linux kernel implements an endpoint-side MHI driver under drivers/bus/mhi/ep/. The vulnerable function mhi_ep_ring_add_element manages producer-consumer ring buffers shared between the endpoint and host. CWE-908 (Use of Uninitialized Resource) is the root cause class: the rd_offset (read pointer) is updated to signal element availability to the host before the buffer write operation completes, creating a memory ordering hazard. The host, observing the advanced pointer, may dereference and process a ring element that contains stale, uninitialized, or partially-written data. Affected product is the Linux kernel across multiple stable branches (CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.3 MEDIUM

Race condition requires favorable timing (AC:H); partial data corruption in ring buffer justifies I:L alongside A:H for potential crash.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 5.8 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Update read pointer only after buffer is written

Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element, resulting in data corruption.

Invoke the buffer write before updating rd_offset to ensure the element is fully written before signaling its availability.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Low
niche driver for PCIe-attached modem hardware, absent in most deployments
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)NVD

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.103 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.44 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.27 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.67 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.29 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.76 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.14 Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130 PATCH https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc PATCH https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a PATCH https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605 ADVISORY https://vuldb.com/vuln/317757 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02853/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02923/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02969/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02997/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03011/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03023/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20577/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20586/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20601/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20602/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20994/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21139/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21179/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20309/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20330/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20560/ REF https://git.kernel.org/stable/c/e2176aa3ba4361e98d9f91178a762dca6cf21fe0

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy