CVE-2025-23151

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: host: Fix race between unprepare and queue_buf

A client driver may use mhiunpreparefromtransfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhiqueuebuf() which will invoke mhigentre(). If mhigentre() runs after mhiunpreparefromtransfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault.

This occurs because mhigentre() does not verify the channel state after locking it. Fix this by having mhigentre() confirm the channel state is valid, or return error to avoid accessing deinitialized data.

[mani: added stable tag]