Medium 4.7Published May 8, 2026

CVE-2026-43415scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend

Updated under an hour ago (Oct 28, 2026, 12:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend In __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel the UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op, POST_CHANGE). This creates a race condition where ufshcd_rtc_work() can still be running while ufshcd_vops_suspend() is executing. When UFSHCD_CAP_CLK_GATING is not supported, the condition !hba->clk_gating.active_reqs is always true, causing ufshcd_update_rtc() to be executed. Since ufshcd_vops_suspend() typically performs clock gating operations, executing ufshcd_update_rtc() at that moment triggers an SError. The kernel panic trace is as follows: Kernel panic - not syncing: Asynchronous SError Interrupt Call trace: dump_backtrace+0xec/0x128 show_stack+0x18/0x28 dump_stack_lvl+0x40/0xa0 dump_stack+0x18/0x24 panic+0x148/0x374 nmi_panic+0x3c/0x8c arm64_serror_panic+0x64/0x8c do_serror+0xc4/0xc8 el1h_64_error_handler+0x34/0x4c el1h_64_error+0x68/0x6c el1_interrupt+0x20/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c ktime_get+0xc4/0x12c ufshcd_mcq_sq_stop+0x4c/0xec ufshcd_mcq_sq_cleanup+0x64/0x1dc ufshcd_clear_cmd+0x38/0x134 ufshcd_issue_dev_cmd+0x298/0x4d0 ufshcd_exec_dev_cmd+0x1a4/0x1c4 ufshcd_query_attr+0xbc/0x19c ufshcd_rtc_work+0x10c/0x1c8 process_scheduled_works+0x1c4/0x45c worker_thread+0x32c/0x3e8 kthread+0x120/0x1d8 ret_from_fork+0x10/0x20 Fix this by moving cancel_delayed_work_sync() before the call to ufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is fully completed or cancelled at that point.

CVSS: 4.7 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 06701a545e9a3c4e007cff6872a074bf97c40619 before a6a894413b043704b77a6294c379c93b1477e48d; 6bf999e0eb41850d5c857102535d5c53b2ede224 builds before 2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69; from 6bf999e0eb41850d5c857102535d5c53b2ede224 before b17211b512cbf0e07de27e1932428ee6c20df910; from 6bf999e0eb41850d5c857102535d5c53b2ede224 before c387a8f1d3713f6b0415ece8485042d0f134b91a; from 6bf999e0eb41850d5c857102535d5c53b2ede224 before b0bd84c39289ef6a6c3827dd52c875659291970a; from 6.6.81 before 6.6.130	CNA record
linux linux_kernel linux:linux_kernel	from 6.6.81 before 6.6.130; from 6.8 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/a6a894413b043704b77a6294c379c93b1477e48d	patch
https://git.kernel.org/stable/c/2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69	patch
https://git.kernel.org/stable/c/b17211b512cbf0e07de27e1932428ee6c20df910	patch
https://git.kernel.org/stable/c/c387a8f1d3713f6b0415ece8485042d0f134b91a	patch
https://git.kernel.org/stable/c/b0bd84c39289ef6a6c3827dd52c875659291970a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.