CVE-2026-43471
- Source
- https://cve.org/CVERecord?id=CVE-2026-43471
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43471.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-43471
- Downstream
BELL (1)
DEBIAN (1)
openSUSE (1)
- Related
- Published
- 2026-05-08T14:22:30Z
- Modified
- 2026-10-08T02:50:54Z
- Summary
- scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq->id. This can happen if ufshcd_mcq_req_to_hwq() returns NULL.
This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash.
Kernel log excerpt: [] notify_die+0x4c/0x8c [] __die+0x60/0xb0 [] die+0x4c/0xe0 [] die_kernel_fault+0x74/0x88 [] __do_kernel_fault+0x314/0x318 [] do_page_fault+0xa4/0x5f8 [] do_translation_fault+0x34/0x54 [] do_mem_abort+0x50/0xa8 [] el1_abort+0x3c/0x64 [] el1h_64_sync_handler+0x44/0xcc [] el1h_64_sync+0x80/0x88 [] ufshcd_add_command_trace+0x23c/0x320 [] ufshcd_compl_one_cqe+0xa4/0x404 [] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [] __handle_irq_event_percpu+0xc8/0x348 [] handle_irq_event+0x3c/0xa8 [] handle_fasteoi_irq+0xf8/0x294 [] generic_handle_domain_irq+0x54/0x80 [] gic_handle_irq+0x1d4/0x330 [] call_on_irq_stack+0x44/0x68 [] do_interrupt_handler+0x78/0xd8 [] el1_interrupt+0x48/0xa8 [] el1h_64_irq_handler+0x14/0x24 [] el1h_64_irq+0x80/0x88 [] arch_local_irq_enable+0x4/0x1c [] cpuidle_enter+0x34/0x54 [] do_idle+0x1dc/0x2f8 [] cpu_startup_entry+0x30/0x3c [] secondary_start_kernel+0x134/0x1ac [] __secondary_switched+0xc4/0xcc
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43471.json" }- References
-
- https://git.kernel.org/stable/c/0614f5618c24fbc3d555efade22887b102ad7ad6
- https://git.kernel.org/stable/c/30df81f2228d65bddf492db3929d9fcaffd38fc5
- https://git.kernel.org/stable/c/93b9e7ee9e93629db80bbc9dab8a874215b89ccf
- https://git.kernel.org/stable/c/be730f9ee92ae08f2bc4b336967bcfd8183c06fe
- https://git.kernel.org/stable/c/f4f590c6c9df7453bbda2ef9170b1b09e42a124c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43471.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-43471
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbed0896008334eeee4b4bfd7150491ca098cbf72Fixed0614f5618c24fbc3d555efade22887b102ad7ad6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9307a998cb9846a2557fdca286997430bee36a2aFixedbe730f9ee92ae08f2bc4b336967bcfd8183c06feFixedf4f590c6c9df7453bbda2ef9170b1b09e42a124cFixed93b9e7ee9e93629db80bbc9dab8a874215b89ccfFixed30df81f2228d65bddf492db3929d9fcaffd38fc5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.41Fixed6.6.130
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.9.10Fixed6.10
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced11d81233f4ebe6907b12c79ad7d8787aa4db0633
Affected versions
v6.*
Linux / Kernel
Package
- Name
- Kernel