In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix ufshcd_abort_one racing issue
When ufshcd_abort_one is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by ISR. Return success when request is completed by ISR because ufshcd_abort_one does not need to do anything.
The racing flow is:
Thread A ufshcd_err_handler step 1 ... ufshcd_abort_one ufshcd_try_to_abort_task ufshcd_cmd_inflight(true) step 3 ufshcd_mcq_req_to_hwq blk_mq_unique_tag rq->mq_hctx->queue_num step 5
Thread B ufs_mtk_mcq_intr(cq complete ISR) step 2 scsi_done ... __blk_mq_free_request rq->mq_hctx = NULL; step 4
Below is KE back trace. ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device. ufshcd_try_to_abort_task: cmd at tag=41 is cleared. Aborting tag 41 / CDB 0x28 succeeded Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194 pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14 lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise] do_mem_abort+0x58/0x118 el1_abort+0x3c/0x5c el1h_64_sync_handler+0x54/0x90 el1h_64_sync+0x68/0x6c blk_mq_unique_tag+0x8/0x14 ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise] process_one_work+0x208/0x4fc worker_thread+0x228/0x438 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1014-ibmUpgrade linux-image-virtualUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-48-lowlatency-64kUpgrade linux-image-awsUpgrade linux-image-6.8.0-48-lowlatencyUpgrade linux-image-6.8.0-48-generic-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-24.04aUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1016-oemUpgrade linux-image-genericUpgrade linux-image-6.8.0-1016-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-48-genericUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1017-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1017-nvidia-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1017-azure-fdeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1014-raspiUpgrade linux-image-6.8.0-1015-oracleUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-24.04Upgrade linux-image-gkeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-1015-oracle-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1018-awsUpgrade linux-image-6.8.0-1016-azureUpgrade linux-image-6.8.0-1016-azure-fdeUpgrade linux-image-6.8.0-1017-nvidia-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1017-azureUpgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1017-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1017-gcpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-6.8.0-1013-gkeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04d | Nov 4, 2024 | Jul 29, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub