CVE-2026-92480

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Validate string descriptors

The string descriptor length includes a two-byte header while the UTF-16

payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code

units, not bytes. Passing the payload byte count can make it read beyond

the descriptor buffer.

Validate that the payload has an even byte count, pass a code-unit count to

the converter, and allocate sufficient UTF-8 output space.

The raw string buffer starts after the descriptor header but its size is

bLength. Copying bLength bytes from that pointer can read beyond the

response buffer.

Allocate a zeroed bLength-sized buffer and copy only the UTF-16

payload. This preserves the raw buffer size consumed by the RPMB device-ID

ABI while avoiding the overread.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References