CVE-2026-92479: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags

The single-doorbell completion path can call ufshcdcomplonecqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error. Avoid that dereference and include the invalid tag in the warning.

Affected Software

1 affected component

Linux Kernel

Event History

Sep 17, 2026

CVE Published

via MITRE·04:09 PM

Data Sourced

via MITRE·04:09 PM

Description

Frequently Asked Questions

What conditions are required to trigger the issue?

The single-doorbell completion path must invoke ufshcd_compl_one_cqe() with a NULL CQE, and no command must be associated with the completion tag. The failure occurs when the kernel emits a warning for that invalid tag and dereferences the NULL CQE while reporting it.

Which systems are exposed?

Systems using the Linux kernel UFS SCSI driver are the relevant scope. The provided information does not identify affected kernel versions, UFS device models, or configuration requirements.

What does the fix change?

The fix avoids dereferencing the CQE when it is NULL during invalid-tag reporting. It instead includes the invalid completion tag in the warning message.