CVE-2026-80661
nicheKernel crash via stale pointer dereference in Linux kernel UFS tracing
The Linux kernel's UFS (Universal Flash Storage) core trace events saved a pointer to the host adapter (hba) structure and dereferenced it inside TP_printk(), which runs when the trace is read from /sys/kernel/tracing/trace, potentially seconds to months after the tracepoint fired. If the hba structure has been freed by that time (e.g., after the UFS device is removed or unbound), the kernel reads freed memory and can crash. A local user with access to the tracing file can therefore trigger a denial of service (kernel crash); the CVSS 3.1 score of 7.8 (local vector, low privileges) rates confidentiality, integrity and availability impacts as high. Affected are Linux systems running kernels whose UFS tracing code dereferences the hba pointer in TP_printk(), which in practice means mobile, embedded and other systems that use UFS storage and have kernel tracing enabled. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS shows only a 0.1% probability of exploitation in the next 30 days, indicating no known exploitation to date.
What to do: Update to a kernel that includes the fix commit 'ufs: core: tracing: Do not dereference pointers in TP_printk()' once it is available for your branch, and check with your distro or device vendor for backports. As an interim mitigation, restrict /sys/kernel/tracing to root and avoid reading UFS traces after unbinding or removing the UFS device or unloading the driver.
| Linux kernel (UFS core tracing, drivers/ufs/core/ufs_trace.h) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TP_printk() The trace events in drivers/ufs/core/ufs_trace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TP_printk() the printing of the dev_name from the ring buffer was converted to using the dev dereferenced pointer from the hba saved pointer. This is not allowed as the TP_printk() is executed at the time the trace event is read from /sys/kernel/tracing/trace file. That can happen literally, seconds, minutes, hours, weeks, days, or even months later! There is no guarantee that the hba pointer will still exist by the time it is dereferenced when the "trace" file is read. Instead, save the device name from the hba pointer at the time the tracepoint is called and place it into the ring buffer event. Then the TP_printk() can read the name directly from the ring buffer and remove the possibility that it will read a freed pointer and crash the kernel. This was detected when testing the trace event code that looks for TP_printk() parameters doing illegal derferences[1] [1] https://lore.kernel.org/all/[email protected]/
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.