Executive brief
A vulnerability was identified in the Linux kernel's Universal Flash Storage (UFS) driver, which manages high-speed data storage in devices like smartphones and tablets. Under certain conditions, such as a storage command timing out, the system could incorrectly handle memory, potentially leading to a system crash or unauthorized access to data. This issue has been resolved in recent kernel updates.
Technical details
A vulnerability in the Linux kernel's UFS (Universal Flash Storage) core driver arises from improper handling of the 'lrbp->cmd' pointer within 'ufshcd_queuecommand()'. The function could be called twice for the same SCSI command before completion, particularly during error handling or timeouts (e.g., via 'scsi_send_eh_cmnd'). The driver previously cleared or checked this pointer in ways that could lead to a double-free (CWE-415) or use-after-free scenario. The fix involves removing unnecessary pointer clearing in error paths and release functions to ensure the command lifecycle is managed correctly by the SCSI mid-layer. This is a local attack vector requiring low privileges, potentially resulting in a complete loss of confidentiality, integrity, and availability.
Affected products
- Linux Linux Kernel 3.12 to 6.1.167, 6.2 to 6.3.13, 6.4 to 6.4.4
Timeline
- 2023-05-24: other: Initial patch authored
- 2025-10-01: advisory: NVD Published Date
- 2026-03-25: patched: Final stable tree backports confirmed