CVE-2026-80690: Linux Kernel UFS Use-After-Free Vulnerability

CVE-2026-80690 Overview

CVE-2026-80690 is a NULL pointer dereference vulnerability in the Linux kernel's Universal Flash Storage (UFS) core subsystem. The flaw resides in the SCSI UFS host controller driver (ufshcd), where the hba->rpmbs list is not initialized during host allocation. If ufs_rpmb_probe() fails during device initialization, the device teardown path dereferences the uninitialized list, triggering a kernel crash.

The issue was resolved by initializing the hba->rpmbs list inside ufshcd_alloc_host(), ensuring the teardown routine can safely traverse the list regardless of probe outcome.

Critical Impact
A failed Replay Protected Memory Block (RPMB) probe leads to a kernel NULL pointer dereference during UFS device teardown, causing local denial of service on affected systems.

Affected Products

Linux kernel versions containing the UFS core driver prior to the fix commits
Systems using Universal Flash Storage (UFS) devices with RPMB partitions
Embedded and mobile platforms relying on ufshcd for storage initialization

Discovery Timeline

2026-08-28 - CVE-2026-80690 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80690

Vulnerability Analysis

The vulnerability sits in the SCSI UFS host controller abstraction (ufshcd) within the Linux kernel. The struct ufs_hba maintains an rpmbs list used to track RPMB partitions exposed by a UFS device. During normal operation, ufs_rpmb_probe() populates this list. When the probe fails, the driver still invokes teardown code that walks the rpmbs list.

Because the list head was never initialized in ufshcd_alloc_host(), the teardown path attempts to dereference a NULL or invalid pointer. This produces an oops in kernel context and halts the initialization sequence. The classification maps to a NULL Pointer Dereference weakness pattern typical of missing initialization in kernel driver lifecycle code.

Root Cause

The hba->rpmbs list head was populated conditionally by ufs_rpmb_probe() rather than unconditionally at host allocation time. The teardown path assumed the list was always valid, creating an ordering bug between probe failure and cleanup. The fix moves list initialization to ufshcd_alloc_host(), ensuring the invariant holds before any teardown can execute.

Attack Vector

Exploitation requires local conditions that cause ufs_rpmb_probe() to fail, such as a malformed or malfunctioning UFS device, malicious hardware presented to the storage stack, or fault injection during boot. A successful trigger produces a kernel panic or unstable state, resulting in denial of service. Remote exploitation is not indicated by the available data.

No verified exploitation code is available. Refer to the upstream commits 0279fd4 and a29db0c for the exact source-level change.

Detection Methods for CVE-2026-80690

Indicators of Compromise

Kernel oops or panic messages referencing ufshcd, ufs_rpmb, or list traversal functions during boot or device hotplug.
Repeated boot failures on systems using UFS storage with RPMB partitions.
dmesg output showing ufs_rpmb_probe failure followed by a NULL pointer dereference backtrace.

Detection Strategies

Inventory Linux kernel versions across endpoints and compare against the patched commits 0279fd4 and a29db0c.
Monitor kernel crash telemetry and kdump reports for stack traces involving ufshcd_remove or RPMB list iteration.
Track vendor kernel advisories for downstream backports covering the UFS core initialization fix.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized data lake for correlation with device model and firmware version.
Alert on unexpected kernel panics on production systems that use UFS storage, particularly during early boot.
Track fleet-wide patch compliance for kernel packages to identify hosts still exposed to the flaw.

How to Mitigate CVE-2026-80690

Immediate Actions Required

Apply the upstream Linux kernel fix or the corresponding distribution kernel update that includes commits 0279fd4 and a29db0c.
Prioritize patching on mobile, embedded, and edge devices that rely on UFS storage with RPMB partitions.
Validate that boot integrity monitoring flags unexpected kernel oops events involving ufshcd.

Patch Information

The fix initializes hba->rpmbs inside ufshcd_alloc_host() so the teardown path always operates on a valid list head. Reference commits: Kernel Git Commit 0279fd4 and Kernel Git Commit a29db0c. Consume vendor kernel packages that backport these commits into stable branches.

Workarounds

No supported workaround replaces the patch. Where patching is delayed, restrict physical and administrative access to systems that could trigger UFS probe failures.
Disable or unbind the UFS RPMB probe path only if the platform and workload permit, and only as a temporary measure until the fixed kernel is deployed.

bash

# Verify running kernel version and confirm the fix is present
uname -r
# Check distribution package changelog for the UFS rpmbs initialization backport
# Example (Debian/Ubuntu):
apt changelog linux-image-$(uname -r) | grep -i "ufshcd\|rpmb"