Executive brief
A race condition in the Linux kernel's Universal Flash Storage (UFS) driver can cause a system crash (kernel panic) when the device enters a low-power suspend mode. This occurs because background maintenance tasks are not properly stopped before the hardware's power management operations begin. While this primarily impacts system stability and availability, it could be used to cause a denial-of-service on affected devices.
Technical details
A race condition exists in the Linux kernel UFS (Universal Flash Storage) core driver within the __ufshcd_wl_suspend() function. The vulnerability is caused by improper synchronization where cancel_delayed_work_sync() for the UFS Real-Time Clock (RTC) work is called after ufshcd_vops_suspend(). On systems where UFSHCD_CAP_CLK_GATING is not supported, the RTC update work may attempt to execute while the hardware clocks are being gated by the suspend process, triggering an asynchronous SError and subsequent kernel panic. An attacker with local access could potentially trigger this race condition during power management transitions to cause a denial-of-service. The fix involves moving the work cancellation before the PRE_CHANGE suspend operations.
Affected products
- Linux Linux Kernel 6.6.81 to 6.6.130, 6.8 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-07: patched: Initial fix committed to mainline kernel
- 2026-05-08: disclosed: CVE-2026-43415 published
References
- https://git.kernel.org/stable/c/2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69
- https://git.kernel.org/stable/c/a6a894413b043704b77a6294c379c93b1477e48d
- https://git.kernel.org/stable/c/b0bd84c39289ef6a6c3827dd52c875659291970a
- https://git.kernel.org/stable/c/b17211b512cbf0e07de27e1932428ee6c20df910
- https://git.kernel.org/stable/c/c387a8f1d3713f6b0415ece8485042d0f134b91a