CVE-2023-52785

What it actually does

Race condition between ufshcd_mcq_abort() and the CQ complete ISR in the Linux kernel UFS driver that clears lprb->cmd, resulting in NULL pointer dereference in scsi_dma_unmap during command abort handling.

Why it matters to the business

Kernel panics and system crashes on servers and devices using UFS storage, causing unplanned downtime, loss of in-flight I/O, and operational disruption until reboot or patch deployment.

How an attack unfolds

An attacker or environmental condition induces a SCSI command timeout while a completion IRQ fires simultaneously; ufshcd_mcq_abort clears the command pointer, and the ISR then dereferences the now-NULL pointer, crashing the kernel.

How to fix it

Apply the upstream fix that resolves the race between ufshcd_mcq_abort and the ISR; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patched kernel no longer exhibits the race by reviewing the ufshcd_mcq_abort and ISR synchronization changes; test with concurrent timeout and IRQ injection scenarios; verify absence of the NULL dereference stack trace in logs.

Typical attack path

1. Issue or induce a UFS/SCSI command that times out
2. Ensure CQ complete IRQ is raised concurrently
3. ufshcd_mcq_abort clears lprb->cmd
4. ISR executes scsi_dma_unmap on NULL pointer
5. Kernel NULL pointer dereference panic occurs

How to detect it

Search kernel logs for strings containing ufshcd_abort, Unable to handle kernel NULL pointer dereference, and the stack trace referencing scsi_dma_unmap and ufshcd_release_scsi_cmd.

• ufshcd_abort: Device abort task at tag
• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108
• scsi_dma_unmap+0xc/0x44
• ufshcd_release_scsi_cmd+0x24/0x114

What your security team should do

• Prioritize kernel updates on all UFS-equipped Linux systems
• Monitor kernel logs for ufshcd_abort and NULL pointer dereference messages
• Enable enhanced SCSI/UFS debugging temporarily to validate the fix