CVE-2026-43471

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()

The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL

pointer dereference when accessing hwq->id. This can happen if

ufshcd_mcq_req_to_hwq() returns NULL.

This patch adds a NULL check for hwq before accessing its id field to

prevent a kernel crash.

Kernel log excerpt:

[<ffffffd5d192dc4c>] notify_die+0x4c/0x8c

[<ffffffd5d1814e58>] __die+0x60/0xb0

[<ffffffd5d1814d64>] die+0x4c/0xe0

[<ffffffd5d181575c>] die_kernel_fault+0x74/0x88

[<ffffffd5d1864db4>] __do_kernel_fault+0x314/0x318

[<ffffffd5d2a3cdf8>] do_page_fault+0xa4/0x5f8

[<ffffffd5d2a3cd34>] do_translation_fault+0x34/0x54

[<ffffffd5d1864524>] do_mem_abort+0x50/0xa8

[<ffffffd5d2a297dc>] el1_abort+0x3c/0x64

[<ffffffd5d2a29718>] el1h_64_sync_handler+0x44/0xcc

[<ffffffd5d181133c>] el1h_64_sync+0x80/0x88

[<ffffffd5d255c1dc>] ufshcd_add_command_trace+0x23c/0x320

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References