net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). Though this feature simplifies the client driver design, it introduces race between the client drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback' for the DL channel may get called before the client driver is fully probed. This means, by the time the dl_callback gets called, the client driver's structures might not be initialized, leading to NULL ptr dereference. Currently, the drivers have to workaround this issue by initializing the internal structures before calling mhi_prepare_for_transfer_autoqueue(). But even so, there is a chance that the client driver's internal code path may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is called, leading to similar NULL ptr dereference. This issue has been reported on the Qcom X1E80100 CRD machines affecting boot. So to properly fix all these races, drop the MHI 'auto_queue' feature altogether and let the client driver (QRTR) manage the RX buffers manually. In the QRTR driver, queue the RX buffers based on the ring length during probe and recycle the buffers in 'dl_callback' once they are consumed. This also warrants removing the setting of 'auto_queue' flag from controller drivers. Currently, this 'auto_queue' feature is only enabled for IPCR DL channel. So only the QRTR client driver requires the modification.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 5.15.63 to before 5.16 | 5.16 | Patch available | CNA |
| Linux | Linux | 5.17 and later | 6.1.191, 6.6.160, 6.12.114, 6.18.17, 6.19.6, 7.0 | Patch available | CNA |
- Linux VendorLinux Affected 5.15.63 to before 5.16 Fixed in 5.16 Patch available CNA
- Linux VendorLinux Affected 5.17 and later Fixed in 6.1.191, 6.6.160, 6.12.114, 6.18.17, 6.19.6, 7.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.15.63 to before 5.16; 5.17 to before 6.18.17; 6.19 to before 6.19.6 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.15.63 to before 5.16; 5.17 to before 6.18.17; 6.19 to before 6.19.6 Vulnerable ·Linux
Remediation
- Fix · CNA Linux (Linux) Fixed in 5.16
- Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.160, 6.12.114, 6.18.17, 6.19.6, 7.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2025-71285
- 2026-10-03 Alias added: GHSA-7g25-3chf-ppwr
- 2026-10-21 Fix available: Linux/[email protected], Linux/[email protected], Linux/Linux@8e130ff078892fa5a6bf272ced7565af58d98a85 +1 · CNA
- 2026-10-21 2 new references · CNA
- 2026-10-30 Fix available: Linux/[email protected], Linux/Linux@b7874c74bcc224fd586679e51b9ded65f66edc2a · CNA
- 2026-10-30 1 new reference · CNA
- 2026-11-05 CISA SSVC decision points changed
References
Patch 3
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2025-71285 · CVE Program
- CVE-2025-71285 · NVD
- FIRST EPSS
- GHSA-7g25-3chf-ppwr · GitHub Advisory Database · CC BY 4.0
- CVE-2025-71285 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences