CVE-2026-92478

What it actually does

The missing validation permits zero or out-of-range RX/TX lane counts to reach TX equalization code, causing out-of-bounds indexing into fixed-size arrays sized by UFS_MAX_LANES and resulting in memory corruption or kernel panic.

Why it matters to the business

Systems using UFS storage controllers may experience unexpected crashes or data corruption during device initialization, leading to downtime and potential loss of storage access on affected Linux kernels.

How an attack unfolds

An attacker with the ability to present a malicious or misconfigured UFS device (or to intercept and alter lane-count responses) supplies an invalid lane count; the kernel uses this value as an array index without bounds checking, triggering memory corruption that can be leveraged for denial of service or, in some configurations, further code execution.

How to fix it

Update the Linux kernel to a version containing the upstream commit that adds lane-count validation before any array indexing; rebuild and deploy the patched kernel across all affected hosts.

How to confirm the fix worked

Confirm the presence of the validation check that rejects zero and out-of-range lane counts (search kernel source for the added bounds test on RX/TX lane counts) and verify the running kernel version includes the fix.

Typical attack path

1. Attacker supplies or spoofs a UFS device reporting zero or excessively large RX/TX lane counts
2. UFS core driver accepts the value and passes it to TX equalization logic
3. Invalid index is used to access an array bounded by UFS_MAX_LANES
4. Out-of-bounds read/write occurs, producing kernel panic or memory corruption
5. Attacker observes crash or attempts to steer corruption toward privilege escalation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for UFS initialization failures or out-of-bounds access warnings around device probe time; correlate with hardware events that introduce new UFS devices.

What your security team should do

• Prioritize kernel updates on all systems that boot with UFS storage controllers
• Monitor vendor and distribution advisories for backported patches
• Test the updated kernel in a staging environment before broad deployment
• Enable kernel crash-dump collection to capture any UFS-related panics for post-incident review