CVE-2026-92477: scsi: ufs: debugfs: Reserve space for a string terminator
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: debugfs: Reserve space for a string terminator
ufssavederrwrite() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator.
Reject an input whose length leaves no room for the trailing NUL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who can trigger this issue?
An attacker needs the ability to write to the affected UFS debugfs interface that reaches ufs_saved_err_write(). The provided information does not identify the required privilege level or whether that interface is available in a default configuration.
What input is required to trigger the vulnerable behavior?
The write must fill the destination stack buffer completely, leaving no space for the trailing NUL terminator before the input is passed to kstrtoint(). Inputs that are rejected because they leave no room for that terminator address the described condition.
How can I determine whether a system has the fix?
Check whether the kernel includes one of the referenced stable commits: b43890843e834300f967c69e74c7c2eb22cb1664, 587be18e0935632ebd367b0f89e37aa5762e400f, or d223989e1a1edad217b673486b093bd157fb6c9a. The supplied data does not map these commits to kernel release versions.