CVE-2025-39674

{"id": "CVE-2025-39674", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e46a28cea29a0ca7d51c811acccf5d119b40c745", "lessThan": "aaf17a35a59572c8b29372883619c3dbb0ebb50a", "versionType": "git"}, {"status": "affected", "version": "e46a28cea29a0ca7d51c811acccf5d119b40c745", "lessThan": "6300d5c5438724c0876828da2f6e2c1a661871fc", "versionType": "git"}], "programFiles": ["drivers/ufs/host/ufs-qcom.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/ufs/host/ufs-qcom.c"], "defaultStatus": "affected"}]}], "published": "2025-09-05T18:15:43.387", "references": [{"url": "https://git.kernel.org/stable/c/6300d5c5438724c0876828da2f6e2c1a661871fc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/aaf17a35a59572c8b29372883619c3dbb0ebb50a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix ESI null pointer dereference\n\nESI/MSI is a performance optimization feature that provides dedicated\ninterrupts per MCQ hardware queue. This is optional feature and UFS MCQ\nshould work with and without ESI feature.\n\nCommit e46a28cea29a (\"scsi: ufs: qcom: Remove the MSI descriptor abuse\")\nbrings a regression in ESI (Enhanced System Interrupt) configuration that\ncauses a null pointer dereference when Platform MSI allocation fails.\n\nThe issue occurs in when platform_device_msi_init_and_alloc_irqs() in\nufs_qcom_config_esi() fails (returns -EINVAL) but the current code uses\n__free() macro for automatic cleanup free MSI resources that were never\nsuccessfully allocated.\n\nUnable to handle kernel NULL pointer dereference at virtual\naddress 0000000000000008\n\n Call trace:\n mutex_lock+0xc/0x54 (P)\n platform_device_msi_free_irqs_all+0x1c/0x40\n ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom]\n ufshcd_config_mcq+0x28/0x104\n ufshcd_init+0xa3c/0xf40\n ufshcd_pltfrm_init+0x504/0x7d4\n ufs_qcom_probe+0x20/0x58 [ufs_qcom]\n\nFix by restructuring the ESI configuration to try MSI allocation first,\nbefore any other resource allocation and instead use explicit cleanup\ninstead of __free() macro to avoid cleanup of unallocated resources.\n\nTested on SM8750 platform with MCQ enabled, both with and without\nPlatform ESI support."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: ufs: ufs-qcom: Correcci\u00f3n de desreferencia de puntero nulo ESI\n\nESI/MSI es una caracter\u00edstica de optimizaci\u00f3n del rendimiento que proporciona interrupciones dedicadas por cola de hardware MCQ. Esta es una caracter\u00edstica opcional y UFS MCQ deber\u00eda funcionar con y sin la caracter\u00edstica ESI.\n\nEl commit e46a28cea29a ('scsi: ufs: qcom: Remove the MSI descriptor abuse') introduce una regresi\u00f3n en la configuraci\u00f3n de ESI (Enhanced System Interrupt) que causa una desreferencia de puntero nulo cuando falla la asignaci\u00f3n de MSI de la plataforma.\n\nEl problema ocurre cuando platform_device_msi_init_and_alloc_irqs() en ufs_qcom_config_esi() falla (devuelve -EINVAL) pero el c\u00f3digo actual utiliza la macro __free() para la limpieza autom\u00e1tica de recursos MSI libres que nunca fueron asignados con \u00e9xito.\n\nNo se puede manejar la desreferencia de puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000008\n\n Traza de llamada:\n mutex_lock+0xc/0x54 (P)\n platform_device_msi_free_irqs_all+0x1c/0x40\n ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom]\n ufshcd_config_mcq+0x28/0x104\n ufshcd_init+0xa3c/0xf40\n ufshcd_pltfrm_init+0x504/0x7d4\n ufs_qcom_probe+0x20/0x58 [ufs_qcom]\n\nSe corrige reestructurando la configuraci\u00f3n de ESI para intentar la asignaci\u00f3n de MSI primero, antes de cualquier otra asignaci\u00f3n de recursos y, en su lugar, usar una limpieza expl\u00edcita en lugar de la macro __free() para evitar la limpieza de recursos no asignados.\n\nProbado en la plataforma SM8750 con MCQ habilitado, tanto con como sin soporte para ESI de plataforma."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26A22BE8-0D22-4155-AED4-BB823BB934AB", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}