CVE-2025-38429
A critical flaw in the Linux kernel’s MHI subsystem allows a race condition that can cause the host to read incomplete or uninitialized data. The issue occurs when the read pointer is updated before the buffer is written, potentially leading to data corruption. The flaw has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, all versions prior to the fix, especially systems that use the MHI (Mobile Host Interface) subsystem such as embedded or mobile devices.
Real-world impact
An attacker could cause the system to read corrupted data, leading to data corruption, crashes, or further exploitation of the affected system.
Why this severity
The CVSS score of 10 reflects that the vulnerability can be exploited remotely without authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the system.
What to do about it
- 011. Update the Linux kernel to a version that includes the fix for CVE-2025-38429.
- 022. Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Jul 25, 2025 · Jul 25, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6h agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 2h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.