CVE-2025-39674

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: ufs-qcom: Fix ESI null pointer dereference

ESI/MSI is a performance optimization feature that provides dedicated

interrupts per MCQ hardware queue. This is optional feature and UFS MCQ

should work with and without ESI feature.

Commit e46a28cea29a ("scsi: ufs: qcom: Remove the MSI descriptor abuse")

brings a regression in ESI (Enhanced System Interrupt) configuration that

causes a null pointer dereference when Platform MSI allocation fails.

The issue occurs in when platform_device_msi_init_and_alloc_irqs() in

ufs_qcom_config_esi() fails (returns -EINVAL) but the current code uses

__free() macro for automatic cleanup free MSI resources that were never

successfully allocated.

Unable to handle kernel NULL pointer dereference at virtual

address 0000000000000008

Call trace:

mutex_lock+0xc/0x54 (P)

platform_device_msi_free_irqs_all+0x1c/0x40

ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom]

ufshcd_config_m

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References