CVE-2026-92480
NoneCVSS
—
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A flaw in reading labels from certain storage devices could let an attacker cause system crashes or see data they are not supposed to access.
- Exploitation
- Other
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Incorrect length handling when converting UTF-16 payload of UFS string descriptors to UTF-8 allows utf16s_to_utf8s to receive byte counts instead of code-unit counts and permits copying bLength bytes past the response buffer, resulting in kernel memory overreads.
Why it matters to the business
Linux systems using UFS storage may experience kernel crashes, instability, or limited information disclosure when processing responses from connected devices; widespread use of UFS in mobile and embedded platforms amplifies exposure.
How an attack unfolds
An attacker supplies a UFS device whose string descriptor responses contain crafted lengths; the kernel driver reads the descriptor, miscalculates the UTF-16 payload size, and passes an oversized count to the converter or copies beyond the allocated response buffer, triggering the overread.
How to fix it
Apply the upstream fix that validates even UTF-16 payload byte counts, passes the correct code-unit count to the converter, allocates a zeroed bLength-sized buffer, and copies only the UTF-16 payload portion.
How to confirm the fix worked
Confirm the presence of the payload even-length check, correct call to utf16s_to_utf8s, and zeroed buffer allocation in the UFS core string descriptor handling code; test with descriptors that previously triggered overreads.
Typical attack path
- Attach or emulate a UFS device that returns malicious string descriptors
- Trigger UFS initialization or RPMB device-ID queries that invoke string descriptor parsing
- Cause utf16s_to_utf8s or raw buffer copy to read past the descriptor boundary
- Observe resulting kernel memory disclosure or crash
How to detect it
Search kernel logs and crash dumps for UFS core string descriptor or utf16s_to_utf8s related faults; correlate with unexpected UFS device attachment events.
What your security team should do
- Patch Linux kernel to the version containing the UFS string descriptor validation fix
- Restrict attachment of untrusted UFS devices in high-security environments
- Monitor kernel logs for UFS-related oops or panics until patching is complete
The record
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer. Validate that the payload has an even byte count, pass a code-unit count to the converter, and allocate sufficient UTF-8 output space. The raw string buffer starts after the descriptor header but its size is bLength. Copying bLength bytes from that pointer can read beyond the response buffer. Allocate a zeroed bLength-sized buffer and copy only the UTF-16 payload. This preserves the raw buffer size consumed by the RPMB device-ID ABI while avoiding the overread.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|