{"id":"CVE-2026-43415","state":"PUBLISHED","title":"scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend\n\nIn __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel\nthe UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op,\nPOST_CHANGE). This creates a race condition where ufshcd_rtc_work() can\nstill be running while ufshcd_vops_suspend() is executing. When\nUFSHCD_CAP_CLK_GATING is not supported, the condition\n!hba->clk_gating.active_reqs is always true, causing ufshcd_update_rtc()\nto be executed. Since ufshcd_vops_suspend() typically performs clock\ngating operations, executing ufshcd_update_rtc() at that moment triggers\nan SError. The kernel panic trace is as follows:\n\nKernel panic - not syncing: Asynchronous SError Interrupt\nCall trace:\n dump_backtrace+0xec/0x128\n show_stack+0x18/0x28\n dump_stack_lvl+0x40/0xa0\n dump_stack+0x18/0x24\n panic+0x148/0x374\n nmi_panic+0x3c/0x8c\n arm64_serror_panic+0x64/0x8c\n do_serror+0xc4/0xc8\n el1h_64_error_handler+0x34/0x4c\n el1h_64_error+0x68/0x6c\n el1_interrupt+0x20/0x58\n el1h_64_irq_handler+0x18/0x24\n el1h_64_irq+0x68/0x6c\n ktime_get+0xc4/0x12c\n ufshcd_mcq_sq_stop+0x4c/0xec\n ufshcd_mcq_sq_cleanup+0x64/0x1dc\n ufshcd_clear_cmd+0x38/0x134\n ufshcd_issue_dev_cmd+0x298/0x4d0\n ufshcd_exec_dev_cmd+0x1a4/0x1c4\n ufshcd_query_attr+0xbc/0x19c\n ufshcd_rtc_work+0x10c/0x1c8\n process_scheduled_works+0x1c4/0x45c\n worker_thread+0x32c/0x3e8\n kthread+0x120/0x1d8\n ret_from_fork+0x10/0x20\n\nFix this by moving cancel_delayed_work_sync() before the call to\nufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is\nfully completed or cancelled at that point.","publishedAt":"2026-05-08T14:21:52.293Z","updatedAt":"2026-05-23T16:06:57.367Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"06701a545e9a3c4e007cff6872a074bf97c40619","status":"affected","lessThan":"a6a894413b043704b77a6294c379c93b1477e48d","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"b17211b512cbf0e07de27e1932428ee6c20df910","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"c387a8f1d3713f6b0415ece8485042d0f134b91a","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"b0bd84c39289ef6a6c3827dd52c875659291970a","versionType":"git"},{"version":"6.6.81","status":"affected","lessThan":"6.6.130","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.19","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.9","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]}],"references":["https://git.kernel.org/stable/c/a6a894413b043704b77a6294c379c93b1477e48d","https://git.kernel.org/stable/c/2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69","https://git.kernel.org/stable/c/b17211b512cbf0e07de27e1932428ee6c20df910","https://git.kernel.org/stable/c/c387a8f1d3713f6b0415ece8485042d0f134b91a","https://git.kernel.org/stable/c/b0bd84c39289ef6a6c3827dd52c875659291970a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43415.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43415","state":"PUBLISHED","datePublished":"2026-05-08T14:21:52.293Z","dateUpdated":"2026-05-23T16:06:57.367Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:56.008Z"},"containers":{"cna":{"title":"scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend\n\nIn __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel\nthe UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op,\nPOST_CHANGE). This creates a race condition where ufshcd_rtc_work() can\nstill be running while ufshcd_vops_suspend() is executing. When\nUFSHCD_CAP_CLK_GATING is not supported, the condition\n!hba->clk_gating.active_reqs is always true, causing ufshcd_update_rtc()\nto be executed. Since ufshcd_vops_suspend() typically performs clock\ngating operations, executing ufshcd_update_rtc() at that moment triggers\nan SError. The kernel panic trace is as follows:\n\nKernel panic - not syncing: Asynchronous SError Interrupt\nCall trace:\n dump_backtrace+0xec/0x128\n show_stack+0x18/0x28\n dump_stack_lvl+0x40/0xa0\n dump_stack+0x18/0x24\n panic+0x148/0x374\n nmi_panic+0x3c/0x8c\n arm64_serror_panic+0x64/0x8c\n do_serror+0xc4/0xc8\n el1h_64_error_handler+0x34/0x4c\n el1h_64_error+0x68/0x6c\n el1_interrupt+0x20/0x58\n el1h_64_irq_handler+0x18/0x24\n el1h_64_irq+0x68/0x6c\n ktime_get+0xc4/0x12c\n ufshcd_mcq_sq_stop+0x4c/0xec\n ufshcd_mcq_sq_cleanup+0x64/0x1dc\n ufshcd_clear_cmd+0x38/0x134\n ufshcd_issue_dev_cmd+0x298/0x4d0\n ufshcd_exec_dev_cmd+0x1a4/0x1c4\n ufshcd_query_attr+0xbc/0x19c\n ufshcd_rtc_work+0x10c/0x1c8\n process_scheduled_works+0x1c4/0x45c\n worker_thread+0x32c/0x3e8\n kthread+0x120/0x1d8\n ret_from_fork+0x10/0x20\n\nFix this by moving cancel_delayed_work_sync() before the call to\nufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is\nfully completed or cancelled at that point."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"06701a545e9a3c4e007cff6872a074bf97c40619","status":"affected","lessThan":"a6a894413b043704b77a6294c379c93b1477e48d","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"b17211b512cbf0e07de27e1932428ee6c20df910","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"c387a8f1d3713f6b0415ece8485042d0f134b91a","versionType":"git"},{"version":"6bf999e0eb41850d5c857102535d5c53b2ede224","status":"affected","lessThan":"b0bd84c39289ef6a6c3827dd52c875659291970a","versionType":"git"},{"version":"6.6.81","status":"affected","lessThan":"6.6.130","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.19","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.9","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/ufs/core/ufshcd.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a6a894413b043704b77a6294c379c93b1477e48d"},{"url":"https://git.kernel.org/stable/c/2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69"},{"url":"https://git.kernel.org/stable/c/b17211b512cbf0e07de27e1932428ee6c20df910"},{"url":"https://git.kernel.org/stable/c/c387a8f1d3713f6b0415ece8485042d0f134b91a"},{"url":"https://git.kernel.org/stable/c/b0bd84c39289ef6a6c3827dd52c875659291970a"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T16:06:57.367Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.81","versionEndExcluding":"6.6.130"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.18.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.19.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}