Executive brief
The Linux kernel's UFS (Ultra Fastpath SCSI) debugfs interface contains a buffer overflow vulnerability in the error handling debug function. A local attacker with debugfs access can write specially crafted input that overwrites the null terminator of a stack buffer, potentially leading to information disclosure or kernel memory corruption affecting system stability.
Technical details
The vulnerability exists in the ufs_saved_err_write() function in drivers/ufs/core/ufs-debugfs.c, which copies user-supplied input into a 16-byte stack-allocated buffer without reserving space for the mandatory NUL terminator. When a write operation provides exactly 16 bytes or more, it overwrites the terminating null byte that the kstrtoint() function depends on for safe string parsing. The fix changes the buffer size check from `count > sizeof(val_str)` to `count >= sizeof(val_str)` to reject inputs that don't leave room for the terminator. Exploitation requires local access to the debugfs interface, which is typically restricted but may be accessible in development or misconfigured systems. The patch has been merged into the Linux kernel stable tree.
Affected products
- Linux Linux Kernel multiple versions (see git.kernel.org/stable for all patched branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-92477 published
- 2026-09-14: patched: Fix merged into Linux kernel stable tree