CVE-2025-37828

scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()

published May 8, 2025

CVSS
—
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()

A race can occur between the MCQ completion path and the abort handler:

once a request completes, __blk_mq_free_request() sets rq->mq_hctx to

NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in

ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is

dereferenced, the kernel will crash.

Add a NULL check for the returned hwq pointer. If hwq is NULL, log an

error and return FAILED, preventing a potential NULL-pointer

dereference. As suggested by Bart, the ufshcd_cmd_inflight() check is

removed.

This is similar to the fix in commit 74736103fb41 ("scsi: ufs: core: Fix

ufshcd_abort_one racing issue").

This is found by our static analysis tool KNighter.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00188 · 8.0th percentile
Published
2025-05-08T06:26Z
EPSS history
Timeline
  • 08 MAY 06:26Z
    scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
    cvelistv5