{"id":"CVE-2025-38119","state":"PUBLISHED","title":"scsi: core: ufs: Fix a hang in the error handler","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: ufs: Fix a hang in the error handler\n\nufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter\nfunction can only succeed if UFSHCD_EH_IN_PROGRESS is not set because\nresuming involves submitting a SCSI command and ufshcd_queuecommand()\nreturns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this\nhang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has\nbeen called instead of before.\n\nBacktrace:\n__switch_to+0x174/0x338\n__schedule+0x600/0x9e4\nschedule+0x7c/0xe8\nschedule_timeout+0xa4/0x1c8\nio_schedule_timeout+0x48/0x70\nwait_for_common_io+0xa8/0x160 //waiting on START_STOP\nwait_for_completion_io_timeout+0x10/0x20\nblk_execute_rq+0xe4/0x1e4\nscsi_execute_cmd+0x108/0x244\nufshcd_set_dev_pwr_mode+0xe8/0x250\n__ufshcd_wl_resume+0x94/0x354\nufshcd_wl_runtime_resume+0x3c/0x174\nscsi_runtime_resume+0x64/0xa4\nrpm_resume+0x15c/0xa1c\n__pm_runtime_resume+0x4c/0x90 // Runtime resume ongoing\nufshcd_err_handler+0x1a0/0xd08\nprocess_one_work+0x174/0x808\nworker_thread+0x15c/0x490\nkthread+0xf4/0x1ec\nret_from_fork+0x10/0x20\n\n[ bvanassche: rewrote patch description ]","publishedAt":"2025-07-03T08:35:26.616Z","updatedAt":"2026-05-11T21:21:37.396Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"f210ea4e7a790c9f5e613e5302175abd539fe9d5","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"f592eb12b43f21dbc972cbe583a12d256901e569","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"ded80255c59a57cd3270d98461f6508730f9767c","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"21f071261f946c5ca1adf378f818082a112b34d2","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"3464a707d137efc8aea1d4ae234d26a28d82b78c","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"bb37f795d01961286b8f768a6d7152f32b589067","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"8a3514d348de87a9d5e2ac00fbac4faae0b97996","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.12","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.186","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.142","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.94","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.34","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.3","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]}],"references":["https://git.kernel.org/stable/c/f210ea4e7a790c9f5e613e5302175abd539fe9d5","https://git.kernel.org/stable/c/f592eb12b43f21dbc972cbe583a12d256901e569","https://git.kernel.org/stable/c/ded80255c59a57cd3270d98461f6508730f9767c","https://git.kernel.org/stable/c/21f071261f946c5ca1adf378f818082a112b34d2","https://git.kernel.org/stable/c/3464a707d137efc8aea1d4ae234d26a28d82b78c","https://git.kernel.org/stable/c/bb37f795d01961286b8f768a6d7152f32b589067","https://git.kernel.org/stable/c/8a3514d348de87a9d5e2ac00fbac4faae0b97996","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38119.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38119","state":"PUBLISHED","datePublished":"2025-07-03T08:35:26.616Z","dateUpdated":"2026-05-11T21:21:37.396Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:23.986Z"},"containers":{"cna":{"title":"scsi: core: ufs: Fix a hang in the error handler","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: ufs: Fix a hang in the error handler\n\nufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter\nfunction can only succeed if UFSHCD_EH_IN_PROGRESS is not set because\nresuming involves submitting a SCSI command and ufshcd_queuecommand()\nreturns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this\nhang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has\nbeen called instead of before.\n\nBacktrace:\n__switch_to+0x174/0x338\n__schedule+0x600/0x9e4\nschedule+0x7c/0xe8\nschedule_timeout+0xa4/0x1c8\nio_schedule_timeout+0x48/0x70\nwait_for_common_io+0xa8/0x160 //waiting on START_STOP\nwait_for_completion_io_timeout+0x10/0x20\nblk_execute_rq+0xe4/0x1e4\nscsi_execute_cmd+0x108/0x244\nufshcd_set_dev_pwr_mode+0xe8/0x250\n__ufshcd_wl_resume+0x94/0x354\nufshcd_wl_runtime_resume+0x3c/0x174\nscsi_runtime_resume+0x64/0xa4\nrpm_resume+0x15c/0xa1c\n__pm_runtime_resume+0x4c/0x90 // Runtime resume ongoing\nufshcd_err_handler+0x1a0/0xd08\nprocess_one_work+0x174/0x808\nworker_thread+0x15c/0x490\nkthread+0xf4/0x1ec\nret_from_fork+0x10/0x20\n\n[ bvanassche: rewrote patch description ]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"f210ea4e7a790c9f5e613e5302175abd539fe9d5","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"f592eb12b43f21dbc972cbe583a12d256901e569","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"ded80255c59a57cd3270d98461f6508730f9767c","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"21f071261f946c5ca1adf378f818082a112b34d2","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"3464a707d137efc8aea1d4ae234d26a28d82b78c","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"bb37f795d01961286b8f768a6d7152f32b589067","versionType":"git"},{"version":"62694735ca95c74dac4eb9068d59801ac0ddebaf","status":"affected","lessThan":"8a3514d348de87a9d5e2ac00fbac4faae0b97996","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.12","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.186","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.142","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.94","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.34","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.3","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f210ea4e7a790c9f5e613e5302175abd539fe9d5"},{"url":"https://git.kernel.org/stable/c/f592eb12b43f21dbc972cbe583a12d256901e569"},{"url":"https://git.kernel.org/stable/c/ded80255c59a57cd3270d98461f6508730f9767c"},{"url":"https://git.kernel.org/stable/c/21f071261f946c5ca1adf378f818082a112b34d2"},{"url":"https://git.kernel.org/stable/c/3464a707d137efc8aea1d4ae234d26a28d82b78c"},{"url":"https://git.kernel.org/stable/c/bb37f795d01961286b8f768a6d7152f32b589067"},{"url":"https://git.kernel.org/stable/c/8a3514d348de87a9d5e2ac00fbac4faae0b97996"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:21:37.396Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"5.10.248"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"5.15.186"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.1.142"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.6.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.12.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.15.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:34:20.294Z"}}]}}}