Executive brief
The Linux kernel's UFS (Universal Flash Storage) driver can crash during device teardown if RPMB (Replay Protected Memory Block) initialization fails. A system administrator or device driver loading process could trigger a NULL pointer dereference causing a kernel panic, disrupting device availability.
Technical details
This is a NULL pointer dereference vulnerability in the Linux kernel's UFS core driver. The vulnerability exists in the device teardown path when ufs_rpmb_probe() fails. The root cause is that the hba->rpmbs list was not initialized in ufshcd_alloc_host(), but was only conditionally initialized later in ufs_rpmb_probe(). If the RPMB probe failed, the list would remain uninitialized, causing a NULL pointer dereference during cleanup. The fix moves the INIT_LIST_HEAD(&hba->rpmbs) call from ufs_rpmb_probe() to ufshcd_alloc_host() to ensure the list is always initialized early. The vulnerability affects systems with UFS devices where RPMB initialization fails. A patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel versions containing commit b06b8c421485 and prior to fix commit 0279fd451a9971c0d5b959fc59f3e11b55e1694e
Timeline
- 2026-08-28: disclosed: Published on NVD
- 2026-07-28: patched: Upstream fix merged by Martin K. Petersen
- 2026-08-09: patched: Included in Linux kernel stable releases