Executive brief
The Linux kernel's Universal Flash Storage (UFS) driver failed to properly validate connected lane counts before using them for array indexing in TX equalization routines. Without proper bounds checking, invalid or out-of-range lane counts could lead to array buffer overflows or out-of-bounds memory access, potentially causing kernel instability or data corruption on systems using UFS storage devices.
Technical details
The vulnerability exists in the Linux kernel's UFS core driver (drivers/ufs/core/ufshcd.c), specifically in the ufshcd_get_max_pwr_mode() function. The function retrieves RX and TX lane counts from device configuration but previously only validated that these values were non-zero, failing to check whether they exceeded UFS_MAX_LANES. These lane counts are subsequently used to index fixed-size arrays, creating a potential out-of-bounds read or write condition. The fix adds explicit bounds validation to reject lane counts exceeding UFS_MAX_LANES before propagation. Attack vectors would require either malicious or malfunctioning UFS device hardware/firmware, or local system access to manipulate device configuration parameters.
Affected products
- Linux Linux kernel All versions with UFS TX equalization support (introduced in commit 03e5d38e2f98, patched in 2026-07-26 and backported to stable branches
Timeline
- 2026-07-17: disclosed
- 2026-07-26: patched
- 2026-09-17: advisory