CVE-2026-43471 (GCVE-0-2026-43471)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:22 – Updated: 2026-05-08 14:22
VLAI?
Title
scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq->id. This can happen if ufshcd_mcq_req_to_hwq() returns NULL. This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash. Kernel log excerpt: [<ffffffd5d192dc4c>] notify_die+0x4c/0x8c [<ffffffd5d1814e58>] __die+0x60/0xb0 [<ffffffd5d1814d64>] die+0x4c/0xe0 [<ffffffd5d181575c>] die_kernel_fault+0x74/0x88 [<ffffffd5d1864db4>] __do_kernel_fault+0x314/0x318 [<ffffffd5d2a3cdf8>] do_page_fault+0xa4/0x5f8 [<ffffffd5d2a3cd34>] do_translation_fault+0x34/0x54 [<ffffffd5d1864524>] do_mem_abort+0x50/0xa8 [<ffffffd5d2a297dc>] el1_abort+0x3c/0x64 [<ffffffd5d2a29718>] el1h_64_sync_handler+0x44/0xcc [<ffffffd5d181133c>] el1h_64_sync+0x80/0x88 [<ffffffd5d255c1dc>] ufshcd_add_command_trace+0x23c/0x320 [<ffffffd5d255bad8>] ufshcd_compl_one_cqe+0xa4/0x404 [<ffffffd5d2572968>] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [<ffffffd5d11c7460>] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [<ffffffd5d19ab92c>] __handle_irq_event_percpu+0xc8/0x348 [<ffffffd5d19abca8>] handle_irq_event+0x3c/0xa8 [<ffffffd5d19b1f0c>] handle_fasteoi_irq+0xf8/0x294 [<ffffffd5d19aa778>] generic_handle_domain_irq+0x54/0x80 [<ffffffd5d18102bc>] gic_handle_irq+0x1d4/0x330 [<ffffffd5d1838210>] call_on_irq_stack+0x44/0x68 [<ffffffd5d183af30>] do_interrupt_handler+0x78/0xd8 [<ffffffd5d2a29c00>] el1_interrupt+0x48/0xa8 [<ffffffd5d2a29ba8>] el1h_64_irq_handler+0x14/0x24 [<ffffffd5d18113c4>] el1h_64_irq+0x80/0x88 [<ffffffd5d2527fb4>] arch_local_irq_enable+0x4/0x1c [<ffffffd5d25282e4>] cpuidle_enter+0x34/0x54 [<ffffffd5d195a678>] do_idle+0x1dc/0x2f8 [<ffffffd5d195a7c4>] cpu_startup_entry+0x30/0x3c [<ffffffd5d18155c4>] secondary_start_kernel+0x134/0x1ac [<ffffffd5d18640bc>] __secondary_switched+0xc4/0xcc
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0614f5618c24fbc3d555efade22887b102ad7ad6 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < be730f9ee92ae08f2bc4b336967bcfd8183c06fe (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f4f590c6c9df7453bbda2ef9170b1b09e42a124c (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 93b9e7ee9e93629db80bbc9dab8a874215b89ccf (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 30df81f2228d65bddf492db3929d9fcaffd38fc5 (git)
Create a notification for this product.
    Linux Linux Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0614f5618c24fbc3d555efade22887b102ad7ad6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "be730f9ee92ae08f2bc4b336967bcfd8183c06fe",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f4f590c6c9df7453bbda2ef9170b1b09e42a124c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "93b9e7ee9e93629db80bbc9dab8a874215b89ccf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "30df81f2228d65bddf492db3929d9fcaffd38fc5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()\n\nThe kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL\npointer dereference when accessing hwq-\u003eid.  This can happen if\nufshcd_mcq_req_to_hwq() returns NULL.\n\nThis patch adds a NULL check for hwq before accessing its id field to\nprevent a kernel crash.\n\nKernel log excerpt:\n[\u003cffffffd5d192dc4c\u003e] notify_die+0x4c/0x8c\n[\u003cffffffd5d1814e58\u003e] __die+0x60/0xb0\n[\u003cffffffd5d1814d64\u003e] die+0x4c/0xe0\n[\u003cffffffd5d181575c\u003e] die_kernel_fault+0x74/0x88\n[\u003cffffffd5d1864db4\u003e] __do_kernel_fault+0x314/0x318\n[\u003cffffffd5d2a3cdf8\u003e] do_page_fault+0xa4/0x5f8\n[\u003cffffffd5d2a3cd34\u003e] do_translation_fault+0x34/0x54\n[\u003cffffffd5d1864524\u003e] do_mem_abort+0x50/0xa8\n[\u003cffffffd5d2a297dc\u003e] el1_abort+0x3c/0x64\n[\u003cffffffd5d2a29718\u003e] el1h_64_sync_handler+0x44/0xcc\n[\u003cffffffd5d181133c\u003e] el1h_64_sync+0x80/0x88\n[\u003cffffffd5d255c1dc\u003e] ufshcd_add_command_trace+0x23c/0x320\n[\u003cffffffd5d255bad8\u003e] ufshcd_compl_one_cqe+0xa4/0x404\n[\u003cffffffd5d2572968\u003e] ufshcd_mcq_poll_cqe_lock+0xac/0x104\n[\u003cffffffd5d11c7460\u003e] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod]\n[\u003cffffffd5d19ab92c\u003e] __handle_irq_event_percpu+0xc8/0x348\n[\u003cffffffd5d19abca8\u003e] handle_irq_event+0x3c/0xa8\n[\u003cffffffd5d19b1f0c\u003e] handle_fasteoi_irq+0xf8/0x294\n[\u003cffffffd5d19aa778\u003e] generic_handle_domain_irq+0x54/0x80\n[\u003cffffffd5d18102bc\u003e] gic_handle_irq+0x1d4/0x330\n[\u003cffffffd5d1838210\u003e] call_on_irq_stack+0x44/0x68\n[\u003cffffffd5d183af30\u003e] do_interrupt_handler+0x78/0xd8\n[\u003cffffffd5d2a29c00\u003e] el1_interrupt+0x48/0xa8\n[\u003cffffffd5d2a29ba8\u003e] el1h_64_irq_handler+0x14/0x24\n[\u003cffffffd5d18113c4\u003e] el1h_64_irq+0x80/0x88\n[\u003cffffffd5d2527fb4\u003e] arch_local_irq_enable+0x4/0x1c\n[\u003cffffffd5d25282e4\u003e] cpuidle_enter+0x34/0x54\n[\u003cffffffd5d195a678\u003e] do_idle+0x1dc/0x2f8\n[\u003cffffffd5d195a7c4\u003e] cpu_startup_entry+0x30/0x3c\n[\u003cffffffd5d18155c4\u003e] secondary_start_kernel+0x134/0x1ac\n[\u003cffffffd5d18640bc\u003e] __secondary_switched+0xc4/0xcc"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T14:22:30.909Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0614f5618c24fbc3d555efade22887b102ad7ad6"
        },
        {
          "url": "https://git.kernel.org/stable/c/be730f9ee92ae08f2bc4b336967bcfd8183c06fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4f590c6c9df7453bbda2ef9170b1b09e42a124c"
        },
        {
          "url": "https://git.kernel.org/stable/c/93b9e7ee9e93629db80bbc9dab8a874215b89ccf"
        },
        {
          "url": "https://git.kernel.org/stable/c/30df81f2228d65bddf492db3929d9fcaffd38fc5"
        }
      ],
      "title": "scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43471",
    "datePublished": "2026-05-08T14:22:30.909Z",
    "dateReserved": "2026-05-01T14:12:56.011Z",
    "dateUpdated": "2026-05-08T14:22:30.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43471\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:17:00.193\",\"lastModified\":\"2026-05-08T15:17:00.193\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()\\n\\nThe kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL\\npointer dereference when accessing hwq-\u003eid.  This can happen if\\nufshcd_mcq_req_to_hwq() returns NULL.\\n\\nThis patch adds a NULL check for hwq before accessing its id field to\\nprevent a kernel crash.\\n\\nKernel log excerpt:\\n[\u003cffffffd5d192dc4c\u003e] notify_die+0x4c/0x8c\\n[\u003cffffffd5d1814e58\u003e] __die+0x60/0xb0\\n[\u003cffffffd5d1814d64\u003e] die+0x4c/0xe0\\n[\u003cffffffd5d181575c\u003e] die_kernel_fault+0x74/0x88\\n[\u003cffffffd5d1864db4\u003e] __do_kernel_fault+0x314/0x318\\n[\u003cffffffd5d2a3cdf8\u003e] do_page_fault+0xa4/0x5f8\\n[\u003cffffffd5d2a3cd34\u003e] do_translation_fault+0x34/0x54\\n[\u003cffffffd5d1864524\u003e] do_mem_abort+0x50/0xa8\\n[\u003cffffffd5d2a297dc\u003e] el1_abort+0x3c/0x64\\n[\u003cffffffd5d2a29718\u003e] el1h_64_sync_handler+0x44/0xcc\\n[\u003cffffffd5d181133c\u003e] el1h_64_sync+0x80/0x88\\n[\u003cffffffd5d255c1dc\u003e] ufshcd_add_command_trace+0x23c/0x320\\n[\u003cffffffd5d255bad8\u003e] ufshcd_compl_one_cqe+0xa4/0x404\\n[\u003cffffffd5d2572968\u003e] ufshcd_mcq_poll_cqe_lock+0xac/0x104\\n[\u003cffffffd5d11c7460\u003e] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod]\\n[\u003cffffffd5d19ab92c\u003e] __handle_irq_event_percpu+0xc8/0x348\\n[\u003cffffffd5d19abca8\u003e] handle_irq_event+0x3c/0xa8\\n[\u003cffffffd5d19b1f0c\u003e] handle_fasteoi_irq+0xf8/0x294\\n[\u003cffffffd5d19aa778\u003e] generic_handle_domain_irq+0x54/0x80\\n[\u003cffffffd5d18102bc\u003e] gic_handle_irq+0x1d4/0x330\\n[\u003cffffffd5d1838210\u003e] call_on_irq_stack+0x44/0x68\\n[\u003cffffffd5d183af30\u003e] do_interrupt_handler+0x78/0xd8\\n[\u003cffffffd5d2a29c00\u003e] el1_interrupt+0x48/0xa8\\n[\u003cffffffd5d2a29ba8\u003e] el1h_64_irq_handler+0x14/0x24\\n[\u003cffffffd5d18113c4\u003e] el1h_64_irq+0x80/0x88\\n[\u003cffffffd5d2527fb4\u003e] arch_local_irq_enable+0x4/0x1c\\n[\u003cffffffd5d25282e4\u003e] cpuidle_enter+0x34/0x54\\n[\u003cffffffd5d195a678\u003e] do_idle+0x1dc/0x2f8\\n[\u003cffffffd5d195a7c4\u003e] cpu_startup_entry+0x30/0x3c\\n[\u003cffffffd5d18155c4\u003e] secondary_start_kernel+0x134/0x1ac\\n[\u003cffffffd5d18640bc\u003e] __secondary_switched+0xc4/0xcc\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0614f5618c24fbc3d555efade22887b102ad7ad6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/30df81f2228d65bddf492db3929d9fcaffd38fc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/93b9e7ee9e93629db80bbc9dab8a874215b89ccf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be730f9ee92ae08f2bc4b336967bcfd8183c06fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4f590c6c9df7453bbda2ef9170b1b09e42a124c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.