CVE-2026-92477: scsi: ufs: debugfs: Reserve space for a string terminator
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: debugfs: Reserve space for a string terminator
ufssavederrwrite() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator.
Reject an input whose length leaves no room for the trailing NUL.
Event History
Frequently Asked Questions
Who can trigger this issue?
An attacker needs the ability to write to the affected UFS debugfs interface that reaches ufs_saved_err_write(). The provided information does not identify the required privilege level or whether that interface is available in a default configuration.
What input is required to trigger the vulnerable behavior?
The write must fill the destination stack buffer completely, leaving no space for the trailing NUL terminator before the input is passed to kstrtoint(). Inputs that are rejected because they leave no room for that terminator address the described condition.
How can I determine whether a system has the fix?
Check whether the kernel includes one of the referenced stable commits: b43890843e834300f967c69e74c7c2eb22cb1664, 587be18e0935632ebd367b0f89e37aa5762e400f, or d223989e1a1edad217b673486b093bd157fb6c9a. The supplied data does not map these commits to kernel release versions.