CVE-2026-80690: scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
Initialize the hba->rpmbs list in ufshcdallochost() to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe() fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems should prioritize validation for this fix?
Systems using the Linux kernel UFS subsystem, particularly those that use RPMB support, should validate the UFS device teardown path after an RPMB probe failure.
What is the observable impact if the affected path is reached?
A failed ufs_rpmb_probe() can leave the hba->rpmbs list uninitialized, causing a NULL pointer dereference during device teardown.
Are fixed kernel versions identified in the available information?
No affected or fixed kernel version numbers are provided. Two stable-kernel fix references are available: a29db0c7f69572b048a63698e1214842d72221e1 and 0279fd451a9971c0d5b959fc59f3e11b55e1694e.