Race Condition Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2025-38429: In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after buffer is written Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for facilitating communication between software applications and the underlying hardware. The kernel is critical for system stability and security, and vulnerabilities within it can have severe implications for the entire operating system.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the MHI (Mobile Host Interface) subsystem. Specifically, within the function mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the associated buffer is fully written. This premature update can lead to race conditions, where the host may access an uninitialized or incomplete element, resulting in potential data corruption. The flaw arises from the incorrect order of operations, which can allow for inconsistent data states and compromise system integrity.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the linux package.
Conclusion
The identified vulnerability in the Linux kernel's MHI subsystem poses significant risks, including potential data corruption and system instability. It is crucial for users to update their linux package to the patched version 6.12.35-1 to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the Linux kernel's MHI subsystem, where the read pointer is updated before the buffer is written.
If exploited, this vulnerability can lead to data corruption and system instability, as the host may access incomplete or uninitialized data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, the vulnerability has been patched in version 6.12.35-1 of the linux package.
While there are no specific workarounds, it is recommended to prioritize updating the package to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
