Riskcovery

CVE-2021-47286

bus: mhi: core: Validate channel ID when processing command completions

State
Published
Severity
Not scored
Published
May 21, 2024
Updated
May 11, 2026
Reserved
May 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: core: Validate channel ID when processing command completions

MHI reads the channel ID from the event ring element sent by the device which can be any value between 0 and 255. In order to prevent any out of bound accesses, add a check against the maximum number of channels supported by the controller and those channels not configured yet so as to skip processing of that event ring element.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 to before 3efec3b4b16fc7af25676a94230a8ab2a3bb867cAffected
  • 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 to before aed4f5b51aba41e2afd7cfda20a0571a6a67dfe9Affected
  • 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 to before 546362a9ef2ef40b57c6605f14e88ced507f8dd0Affected
LinuxLinux
  • 5.7Affected
  • before 5.7Not affected
  • 5.10.54 through 5.10.*Not affected
  • 5.13.6 through 5.13.*Not affected
  • 5.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.