Cloudanix VulnDB

CVE-2026-92479

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux storage driver can make computers using certain flash storage chips crash when they encounter an unusual error condition.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in the UFS SCSI driver's single-doorbell completion path when ufshcd_compl_one_cqe() receives a NULL CQE for an invalid tag and the subsequent warning message attempts to dereference it.

Why it matters to the business

Unexpected kernel crashes or system instability on Linux hosts using UFS storage controllers, leading to downtime and potential data access loss until the kernel is updated.

How an attack unfolds

An attacker triggers an invalid completion tag in the UFS command path, causing the single-doorbell handler to invoke the completion function with a NULL CQE; the error-reporting code then dereferences the NULL pointer, resulting in a crash.

How to fix it

Update the Linux kernel to a version containing the fix that guards the warning message against NULL CQE dereference and logs the invalid tag instead; apply vendor-supplied kernel packages as soon as they become available.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds a NULL check before dereferencing the CQE in ufshcd_compl_one_cqe() and verifies the warning now prints the tag value; recompile or install the patched kernel and exercise UFS error paths in a test environment.

Typical attack path

  1. Gain local or remote access sufficient to issue UFS commands or manipulate the doorbell registers
  2. Force an invalid tag into the completion queue
  3. Trigger the single-doorbell completion path with a NULL CQE
  4. Induce the warning code path that dereferences the NULL pointer
  5. Cause kernel panic or denial of service

How to detect it

Review kernel logs for UFS completion warnings mentioning invalid tags or NULL CQE; examine crash dumps for dereference in ufshcd_compl_one_cqe or related doorbell paths; correlate with UFS command timeout or error events.

What your security team should do

  • Prioritize kernel updates for all systems exposing UFS storage
  • Monitor vendor advisories for backported fixes in supported distributions
  • Restrict unprivileged access to raw UFS or SCSI interfaces where feasible
  • Include UFS-related kernel modules in crash-dump analysis playbooks

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error. Avoid that dereference and include the invalid tag in the warning.

Affected packages

Ecosystem Package Introduced Fixed