CVE-2026-43471 Overview
CVE-2026-43471 is a NULL pointer dereference vulnerability in the Linux kernel's Universal Flash Storage (UFS) SCSI subsystem. The flaw resides in the ufshcd_add_command_trace() function within the UFS host controller driver core. When ufshcd_mcq_req_to_hwq() returns NULL, subsequent access to hwq->id triggers a kernel page fault and system crash. The issue affects systems using the Multi-Circular Queue (MCQ) mode of UFS, observed on MediaTek platforms via the ufs_mtk_mcq_intr interrupt path. The upstream fix introduces a NULL check before dereferencing the hardware queue pointer.
Critical Impact
Local triggering of the NULL pointer dereference results in a kernel crash and denial of service on affected Linux systems using UFS storage with MCQ support.
Affected Products
- Linux kernel versions containing the UFS MCQ command tracing code path in drivers/ufs/core/
- Systems using UFS storage with MCQ mode enabled, including MediaTek-based platforms via the ufs_mediatek_mod module
- Stable kernel branches referenced by commits 0614f56, 30df81f, 93b9e7e, be730f9, and f4f590c
Discovery Timeline
- 2026-05-08 - CVE-2026-43471 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43471
Vulnerability Analysis
The vulnerability resides in ufshcd_add_command_trace(), a tracing helper invoked during UFS command completion. The function calls ufshcd_mcq_req_to_hwq() to map an SCSI request to its corresponding hardware queue (hwq). The original code assumes the returned pointer is always valid and immediately dereferences hwq->id for trace event emission.
Under certain race or completion conditions, ufshcd_mcq_req_to_hwq() can return NULL. The kernel oops trace shows the fault propagating from ufshcd_compl_one_cqe through ufshcd_mcq_poll_cqe_lock and into the MediaTek MCQ interrupt handler ufs_mtk_mcq_intr. The resulting translation fault crashes the kernel via el1_abort and die_kernel_fault. This pattern is classified as [CWE-476] NULL Pointer Dereference and produces a denial of service on the affected host.
Root Cause
The root cause is the missing NULL check on the hardware queue pointer returned by ufshcd_mcq_req_to_hwq() before reading the id field. The upstream patch adds a guard that validates hwq is non-NULL prior to use, preventing the dereference and the subsequent oops.
Attack Vector
The issue triggers locally through the storage I/O completion path, not via remote network input. An attacker or workload that can reliably induce the race condition on the MCQ completion path may force repeated kernel crashes. The vulnerability impacts availability of the affected host; no code execution or privilege escalation has been documented.
The vulnerability mechanism is a missing pointer validation before dereference. Refer to the upstream commits for the exact patch source.
Detection Methods for CVE-2026-43471
Indicators of Compromise
- Kernel oops messages referencing ufshcd_add_command_trace+0x23c/0x320 in dmesg or /var/log/kern.log
- Page fault traces showing do_translation_fault followed by el1h_64_sync_handler originating from UFS MCQ completion paths
- Unexpected reboots or storage subsystem hangs on systems running UFS MCQ with the MediaTek UFS driver loaded
Detection Strategies
- Audit running kernel versions against the fixed commits 0614f56, 30df81f, 93b9e7e, be730f9, and f4f590c using uname -r and distribution package metadata
- Monitor kernel ring buffer for crash signatures matching the ufshcd_compl_one_cqe → ufshcd_add_command_trace call chain
- Correlate storage subsystem errors with MCQ interrupt handler activity through tracing tools such as ftrace or perf
Monitoring Recommendations
- Centralize kernel logs from Linux hosts and alert on oops or panic events that reference UFS functions
- Track patch deployment status across kernel fleets using configuration management telemetry
- Watch for crash loops on devices using UFS storage, particularly mobile and embedded systems with MediaTek SoCs
How to Mitigate CVE-2026-43471
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits Linux Kernel Commit 0614f56, Linux Kernel Commit 30df81f, Linux Kernel Commit 93b9e7e, Linux Kernel Commit be730f9, and Linux Kernel Commit f4f590c
- Schedule kernel upgrades on systems using UFS MCQ, prioritizing devices with the MediaTek UFS driver loaded
- Verify the fix by inspecting ufshcd_add_command_trace() for the added NULL check on hwq
Patch Information
The fix adds a NULL check for the hwq pointer before accessing hwq->id in ufshcd_add_command_trace(). Distribution vendors are issuing rebased stable kernel packages incorporating the upstream commits listed above. Apply the vendor-supplied kernel update appropriate for your distribution and reboot.
Workarounds
- Where patching is not immediately feasible, evaluate disabling UFS MCQ mode if the platform supports legacy single-queue operation
- Restrict workloads that exercise heavy concurrent UFS I/O on unpatched hosts to reduce the likelihood of triggering the race
- Maintain crash dump collection (kdump) to capture forensic evidence if the oops recurs in production
# Verify installed kernel version and check for the fix
uname -r
# On Debian/Ubuntu, update the kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-generic
# On RHEL/Fedora
sudo dnf update kernel
# Reboot to load the patched kernel
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
