Executive brief
The Linux kernel's UFS (Universal Flash Storage) driver has a bug in how it reads string descriptors from storage devices. The driver can read beyond allocated memory buffers when processing device strings, potentially exposing sensitive kernel memory or causing system crashes. This affects any system using UFS storage devices.
Technical details
The vulnerability exists in the ufshcd_read_string_desc() function in drivers/ufs/core/ufshcd.c. String descriptors include a two-byte header followed by UTF-16 payload, but the code miscalculated buffer sizes and passed incorrect byte counts to the utf16s_to_utf8s() converter, which expects a count of UTF-16 code units. Additionally, kmemdup() could copy beyond the actual payload into uninitialized memory. The fix validates that payload length is even, correctly converts byte counts to code-unit counts, allocates properly-sized buffers, and uses memcpy with validated lengths to avoid overreads.
Affected products
- Linux Linux kernel multiple versions before the 2026-07-26 fix
Timeline
- 2026-07-26: disclosed
- 2026-07-26: patched