https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:44:42 +0000 https://cve.radiocsirt.org/vuln/cve-2026-43471 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()</p> <p>The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq-&gt;id. This can happen if ufshcd_mcq_req_to_hwq() returns NULL.</p> <p>This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash.</p> <p>Kernel log excerpt: [&lt;ffffffd5d192dc4c&gt;] notify_die+0x4c/0x8c [&lt;ffffffd5d1814e58&gt;] __die+0x60/0xb0 [&lt;ffffffd5d1814d64&gt;] die+0x4c/0xe0 [&lt;ffffffd5d181575c&gt;] die_kernel_fault+0x74/0x88 [&lt;ffffffd5d1864db4&gt;] __do_kernel_fault+0x314/0x318 [&lt;ffffffd5d2a3cdf8&gt;] do_page_fault+0xa4/0x5f8 [&lt;ffffffd5d2a3cd34&gt;] do_translation_fault+0x34/0x54 [&lt;ffffffd5d1864524&gt;] do_mem_abort+0x50/0xa8 [&lt;ffffffd5d2a297dc&gt;] el1_abort+0x3c/0x64 [&lt;ffffffd5d2a29718&gt;] el1h_64_sync_handler+0x44/0xcc [&lt;ffffffd5d181133c&gt;] el1h_64_sync+0x80/0x88 [&lt;ffffffd5d255c1dc&gt;] ufshcd_add_command_trace+0x23c/0x320 [&lt;ffffffd5d255bad8&gt;] ufshcd_compl_one_cqe+0xa4/0x404 [&lt;ffffffd5d2572968&gt;] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [&lt;ffffffd5d11c7460&gt;] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [&lt;ffffffd5d19ab92c&gt;] __handle_irq_event_percpu+0xc8/0x348 [&lt;ffffffd5d19abca8&gt;] handle_irq_event+0x3c/0xa8 [&lt;ffffffd5d19b1f0c&gt;] handle_fasteoi_irq+0xf8/0x294 [&lt;ffffffd5d19aa778&gt;] generic_handle_domain_irq+0x54/0x80 [&lt;ffffffd5d18102bc&gt;] gic_handle_irq+0x1d4/0x330 [&lt;ffffffd5d1838210&gt;] call_on_irq_stack+0x44/0x68 [&lt;ffffffd5d1…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()</p> <p>The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq-&gt;id. This can happen if ufshcd_mcq_req_to_hwq() returns NULL.</p> <p>This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash.</p> <p>Kernel log excerpt: [&lt;ffffffd5d192dc4c&gt;] notify_die+0x4c/0x8c [&lt;ffffffd5d1814e58&gt;] __die+0x60/0xb0 [&lt;ffffffd5d1814d64&gt;] die+0x4c/0xe0 [&lt;ffffffd5d181575c&gt;] die_kernel_fault+0x74/0x88 [&lt;ffffffd5d1864db4&gt;] __do_kernel_fault+0x314/0x318 [&lt;ffffffd5d2a3cdf8&gt;] do_page_fault+0xa4/0x5f8 [&lt;ffffffd5d2a3cd34&gt;] do_translation_fault+0x34/0x54 [&lt;ffffffd5d1864524&gt;] do_mem_abort+0x50/0xa8 [&lt;ffffffd5d2a297dc&gt;] el1_abort+0x3c/0x64 [&lt;ffffffd5d2a29718&gt;] el1h_64_sync_handler+0x44/0xcc [&lt;ffffffd5d181133c&gt;] el1h_64_sync+0x80/0x88 [&lt;ffffffd5d255c1dc&gt;] ufshcd_add_command_trace+0x23c/0x320 [&lt;ffffffd5d255bad8&gt;] ufshcd_compl_one_cqe+0xa4/0x404 [&lt;ffffffd5d2572968&gt;] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [&lt;ffffffd5d11c7460&gt;] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [&lt;ffffffd5d19ab92c&gt;] __handle_irq_event_percpu+0xc8/0x348 [&lt;ffffffd5d19abca8&gt;] handle_irq_event+0x3c/0xa8 [&lt;ffffffd5d19b1f0c&gt;] handle_fasteoi_irq+0xf8/0x294 [&lt;ffffffd5d19aa778&gt;] generic_handle_domain_irq+0x54/0x80 [&lt;ffffffd5d18102bc&gt;] gic_handle_irq+0x1d4/0x330 [&lt;ffffffd5d1838210&gt;] call_on_irq_stack+0x44/0x68 [&lt;ffffffd5d1…</p> https://cve.radiocsirt.org/vuln/cve-2026-43471