CVE-2024-41054

What it actually does

Race condition between ufshcd_clear_cmd and the completion ISR allows the ISR to NULL rq->mq_hctx after ufshcd_cmd_inflight check but before ufshcd_mcq_req_to_hwq, causing NULL dereference in blk_mq_unique_tag inside the error handler workqueue.

Why it matters to the business

Systems using affected UFS controllers experience unpredictable kernel crashes during storage error recovery, leading to downtime, potential data loss in flight, and the need for immediate kernel updates across fleets.

How an attack unfolds

An attacker with the ability to induce UFS command timeouts or device errors triggers ufshcd_err_handler; concurrent completion of the same request by the ISR races with the abort path, resulting in the NULL pointer dereference and kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit bed0896008334eeee4b4bfd7150491ca098cbf72 in the stable tree; rebuild and deploy the fixed kernel image on all affected hosts.

How to confirm the fix worked

Confirm the running kernel contains the cited commit or is newer than the vulnerable versions; reproduce the race scenario in a test environment and verify absence of the NULL dereference oops.

Typical attack path

1. Induce conditions that mark a UFS command as needing abort (timeout, device error)
2. ufshcd_err_handler queues ufshcd_try_to_abort_task
3. ufshcd_clear_cmd calls ufshcd_mcq_req_to_hwq while ISR runs
4. ISR sets rq->mq_hctx to NULL via __blk_mq_free_request
5. blk_mq_unique_tag dereferences the now-NULL pointer and panics

How to detect it

Search kernel logs and crash dumps for the strings ufshcd_try_to_abort_task, ufshcd_clear_cmd, blk_mq_unique_tag, and the backtrace containing ufs_mtk_mcq_intr or ufs_eh_wq.

• ufshcd_try_to_abort_task: cmd pending in the device. tag =
• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194
• blk_mq_unique_tag+0x8/0x14
• ufshcd_clear_cmd+0x34/0x118
• ufshcd_err_handler+0xa7c/0xfa8
• Workqueue: ufs_eh_wq

What your security team should do

• Apply the fixed kernel immediately on all UFS-equipped systems
• Monitor kernel logs for ufshcd_err_handler and blk_mq_unique_tag crashes
• Prioritize updates on production storage servers before development systems