CVE-2025-39790

What it actually does

The flaw allows a remote device to send a completion event containing a stale or unexpected TRE pointer. When the host processes this pointer against its local read pointer, it can treat a single-element transaction as chained, leading to double-free of buffers via xfer_cb() on the same memory region.

Why it matters to the business

Systems running vulnerable Linux kernels on MHI-enabled hardware face elevated risk of local privilege escalation, kernel crashes, and memory corruption that can disrupt device operation or allow an attacker with local access to execute arbitrary code.

How an attack unfolds

An attacker with local access on an affected system triggers or waits for a device to send a malformed completion event pointing to an old TRE. The host misinterprets the gap between pointers as a chained transaction and frees the same buffer twice, resulting in memory corruption that can be leveraged for privilege escalation.

How to fix it

Update to a fixed kernel containing commit 7b3f0e3b60c27f4fcb69927d84987e5fd6240530 or later. For MinimOS-based products upgrade kwok and kwokctl to version 0.7.0-r3 or newer. Reboot after applying the update and verify the running kernel includes the fix.

How to confirm the fix worked

Confirm the installed kernel version contains commit 7b3f0e3b60c27f4fcb69927d84987e5fd6240530. Test MHI event ring processing under load to ensure events pointing outside the expected single-element window are now treated as chained transactions. Monitor for absence of double-free crashes in affected code paths.

Typical attack path

1. Obtain local access on a system using the vulnerable MHI host driver
2. Trigger or observe a device-generated completion event with a stale TRE pointer
3. Cause the host to process the event as a chained transaction spanning multiple ring entries
4. Trigger double-free of the buffer via the channel callback
5. Exploit the resulting memory corruption for privilege escalation or denial of service

How to detect it

Search kernel logs and crash dumps for double-free reports or warnings originating from MHI host channel callbacks. Monitor for unexpected TRE pointer values in event ring processing and correlate with MHI device activity. Review dmesg and kdump artifacts for stale pointer dereferences after device events.

What your security team should do

• Apply the kernel patch or MinimOS update immediately given the memory corruption impact
• Prioritize systems with MHI hardware or embedded Linux deployments
• Review and restrict local access on affected devices until patched
• Add kernel version checks to vulnerability scanning and asset inventory