Executive brief
The Linux kernel's UFS (Universal Flash Storage) driver contains a deadlock vulnerability in its TX Equalization (TX EQTR) code path. When the system performs power-mode scaling operations that suspend I/O, the TX EQTR functions allocate memory in a way that can trigger disk I/O during memory reclamation, causing the system to deadlock. This can result in system hangs or unresponsiveness during power management operations on devices using UFS storage.
Technical details
The vulnerability is a potential deadlock condition in the UFS core driver's TX equalization code (drivers/ufs/core/ufs-txeq.c). The ufshcd_tx_eqtr() function and its callees (__ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom()) allocate memory using GFP_KERNEL while the I/O tagset is quiesced during devfreq power-mode scaling. If the kernel triggers direct memory reclaim, the reclaim/writeback operations may attempt to issue I/O to the UFS device; since the queue is quiesced, this causes a deadlock. The fix applies memalloc_noio_save/restore() in ufshcd_tx_eqtr() to propagate GFP_NOIO semantics to all allocations in the call tree, preventing I/O-dependent memory reclaim. Local system processes can trigger this via power management state changes, making it reachable without authentication or network access.
Affected products
- Linux Linux kernel multiple versions; patch released June 2026
Timeline
- 2026-09-17: disclosed
- 2026-06-18: patched: Fix committed upstream; backported to stable branches