CVE-2026-43415
Race Condition in Linux Kernel UFS Driver Leads to SError
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's UFS (Universal Flash Storage) subsystem. It is caused by a race condition in the suspend process of the UFS host controller driver. Specifically, the function cancel_delayed_work_sync() is called too late, after ufshcd_vops_suspend(), allowing the ufshcd_rtc_work() function to run concurrently with suspend operations.
When the hardware does not support clock gating, a condition causes ufshcd_update_rtc() to be executed during clock gating operations, which triggers an asynchronous SError interrupt leading to a kernel panic.
The fix involves moving the cancel_delayed_work_sync() call to before ufshcd_vops_suspend(), ensuring that the UFS RTC work is fully completed or cancelled before suspend operations proceed, preventing the race condition and subsequent kernel panic.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to panic unexpectedly due to an asynchronous SError interrupt triggered during UFS suspend operations.
A kernel panic results in a system crash, which can lead to data loss, system downtime, and reduced reliability of devices using affected Linux kernel versions with UFS storage.
Systems relying on UFS storage and running vulnerable Linux kernel versions may experience instability or crashes during suspend/resume cycles.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel panic with an Asynchronous SError Interrupt related to the UFS suspend process in the Linux kernel.
Detection can be done by monitoring system logs for kernel panic messages that include traces similar to the following call trace: dump_backtrace, show_stack, panic, nmi_panic, arm64_serror_panic, ufshcd_rtc_work, and related functions.
You can check the kernel logs using commands such as:
- dmesg | grep -i 'Kernel panic'
- journalctl -k | grep -i 'SError Interrupt'
- journalctl -k | grep -i 'ufshcd_rtc_work'
Additionally, monitoring for unexpected system reboots or crashes related to UFS device suspend operations can help identify this issue.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by changing the order of operations in the Linux kernel code to ensure that cancel_delayed_work_sync() is called before ufshcd_vops_suspend(), preventing the race condition.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- If updating immediately is not possible, avoid suspending UFS devices or disable UFS suspend features temporarily to prevent triggering the race condition.
- Monitor system stability and logs for signs of kernel panics related to UFS suspend operations.