Executive brief
A vulnerability in the Linux kernel's storage subsystem could allow a local user to cause a system crash. The issue occurs when the system attempts to trace storage commands for Universal Flash Storage (UFS) devices. This results in a 'kernel panic' or crash, which can disrupt operations and lead to a denial of service for the affected machine.
Technical details
A NULL pointer dereference exists in the ufshcd_add_command_trace() function within the Linux kernel's UFS core driver (drivers/ufs/core/ufshcd.c). The vulnerability is triggered when Multi-Circular Queue (MCQ) is enabled and the function ufshcd_mcq_req_to_hwq() returns a NULL pointer. When the code subsequently attempts to access the 'id' field of this NULL hardware queue object (hwq->id), it causes a kernel oops/crash. This is a local denial-of-service vulnerability. Patches have been released for various stable kernel branches to add a proper NULL check before the pointer is dereferenced.
Affected products
- Linux Linux Kernel 6.6, 6.1, 6.13, 6.14
Timeline
- 2026-02-23: other: Patch submitted by developer Peter Wang
- 2026-03-25: patched: Committed to stable kernel trees
- 2026-05-08: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0614f5618c24fbc3d555efade22887b102ad7ad6
- https://git.kernel.org/stable/c/30df81f2228d65bddf492db3929d9fcaffd38fc5
- https://git.kernel.org/stable/c/93b9e7ee9e93629db80bbc9dab8a874215b89ccf
- https://git.kernel.org/stable/c/be730f9ee92ae08f2bc4b336967bcfd8183c06fe
- https://git.kernel.org/stable/c/f4f590c6c9df7453bbda2ef9170b1b09e42a124c