CVE-2026-92477

What it actually does

The vulnerability allows an attacker to supply input to ufs_saved_err_write() that exactly fills the stack buffer, overwriting the null terminator, which can lead to out-of-bounds access or incorrect parsing when passed to kstrtoint().

Why it matters to the business

Local users on affected Linux systems could potentially cause kernel crashes or memory corruption, impacting system stability and security; current low exploit prevalence and lack of known campaigns reduce immediate operational risk.

How an attack unfolds

An attacker with write access to the debugfs file writes a string of maximum buffer length without null, causing the buffer to lack termination and subsequent functions to read beyond bounds.

How to fix it

Apply the kernel patch that rejects inputs without room for the trailing NUL in ufs_saved_err_write().

How to confirm the fix worked

Verify the presence of the fix by checking the kernel source for the length check before copying in ufs_saved_err_write().

Typical attack path

1. Identify UFS debugfs entry
2. Write oversized string to ufs_saved_err file
3. Trigger kstrtoint parsing
4. Exploit resulting memory issues

How to detect it

Look for unusual writes to UFS debugfs entries in system logs or audit trails indicating attempts to overflow the buffer.

What your security team should do

• Update Linux kernel to a version containing the fix
• Monitor for local privilege escalation attempts
• Restrict access to debugfs if possible