Skip to content
OpenAdvisories
Unscored CVE-2024-41053 EUVD-2024-38853GHSA-f9fx-wvgj-vvxm

scsi: ufs: core: Fix ufshcd_abort_one racing issue

Published Jul 29, 2024 · Updated May 23, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix ufshcd_abort_one racing issue

When ufshcd_abort_one is racing with the completion ISR, the completed tag
of the request's mq_hctx pointer will be set to NULL by ISR. Return
success when request is completed by ISR because ufshcd_abort_one does not
need to do anything.

The racing flow is:

Thread A
ufshcd_err_handler step 1
...
ufshcd_abort_one
ufshcd_try_to_abort_task
ufshcd_cmd_inflight(true) step 3
ufshcd_mcq_req_to_hwq
blk_mq_unique_tag
rq->mq_hctx->queue_num step 5

Thread B
ufs_mtk_mcq_intr(cq complete ISR) step 2
scsi_done
...
__blk_mq_free_request
rq->mq_hctx = NULL; step 4

Below is KE back trace.
ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.
ufshcd_try_to_abort_task: cmd at tag=41 is cleared.
Aborting tag 41 / CDB 0x28 succeeded
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194
pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14
lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]
do_mem_abort+0x58/0x118
el1_abort+0x3c/0x5c
el1h_64_sync_handler+0x54/0x90
el1h_64_sync+0x68/0x6c
blk_mq_unique_tag+0x8/0x14
ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]
process_one_work+0x208/0x4fc
worker_thread+0x228/0x438
kthread+0x104/0x1d4
ret_from_fork+0x10/0x20

Affected products

VendorProductAffectedFixed
Linux Linux 6.6.5 – < 6.6.41, 6.7 6.6.41

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.9.10-1 —
Debian 13 linux 6.9.10-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux 6.8.0-48.48 USN-7089-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1018.20 USN-7089-3
Ubuntu 24.04 LTS linux-azure 6.8.0-1017.20 USN-7089-2
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1017.19 USN-7095-1, USN-7089-2
Ubuntu 24.04 LTS linux-gke 6.8.0-1013.17 USN-7089-6
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1002.4 USN-7156-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1015.15 USN-7089-2
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-48.48.3 USN-7089-7
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1017.19.1 USN-7095-1
Ubuntu 24.04 LTS linux-oem-6.8 6.8.0-1016.16 USN-7089-4
Ubuntu 24.04 LTS linux-oracle 6.8.0-1015.16 USN-7089-3
Ubuntu 24.04 LTS linux-raspi 6.8.0-1014.16 USN-7089-5
Ubuntu 24.04 LTS linux-riscv 6.8.0-48.48.1 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1018.19~22.04.1 USN-7089-3
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1017.20~22.04.1 USN-7090-1
Ubuntu 22.04 LTS linux-gcp-6.8 +1 6.8.0-1017.19~22.04.1 USN-7095-1, USN-7089-1
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-48.48~22.04.1 USN-7089-1
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-48.48.3~22.04.1 USN-7089-7
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1015.15~22.04.1 USN-7089-3
Ubuntu 22.04 LTS linux-riscv +31 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.8 6.8.0-48.48.1~22.04.2 —
Ubuntu 20.04 LTS linux-gke +26 No fix yet —
Ubuntu 18.04 LTS linux-gcp +13 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2013.14 —
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1011.11 —

Advisories 11

References