CVE-2025-37828 (GCVE-0-2025-37828)

Vulnerability from cvelistv5 – Published: 2025-05-08 06:26 – Updated: 2026-05-11 21:15
VLAI
Title
scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() A race can occur between the MCQ completion path and the abort handler: once a request completes, __blk_mq_free_request() sets rq->mq_hctx to NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is dereferenced, the kernel will crash. Add a NULL check for the returned hwq pointer. If hwq is NULL, log an error and return FAILED, preventing a potential NULL-pointer dereference. As suggested by Bart, the ufshcd_cmd_inflight() check is removed. This is similar to the fix in commit 74736103fb41 ("scsi: ufs: core: Fix ufshcd_abort_one racing issue"). This is found by our static analysis tool KNighter.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f1304d4420777f82a1d844c606db3d9eca841765 , < d6979fabe812a168d5053e5a41d5a2e9b8afd7bf (git)
Affected: f1304d4420777f82a1d844c606db3d9eca841765 , < 7d002f591486f5ef4bc02eb02025a53f931f0eb5 (git)
Affected: f1304d4420777f82a1d844c606db3d9eca841765 , < 47eec518aef3814f64a5da43df81bdd74d8c0041 (git)
Affected: f1304d4420777f82a1d844c606db3d9eca841765 , < 4c324085062919d4e21c69e5e78456dcec0052fe (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.89 , ≤ 6.6.* (semver)
Unaffected: 6.12.26 , ≤ 6.12.* (semver)
Unaffected: 6.14.5 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufs-mcq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6979fabe812a168d5053e5a41d5a2e9b8afd7bf",
              "status": "affected",
              "version": "f1304d4420777f82a1d844c606db3d9eca841765",
              "versionType": "git"
            },
            {
              "lessThan": "7d002f591486f5ef4bc02eb02025a53f931f0eb5",
              "status": "affected",
              "version": "f1304d4420777f82a1d844c606db3d9eca841765",
              "versionType": "git"
            },
            {
              "lessThan": "47eec518aef3814f64a5da43df81bdd74d8c0041",
              "status": "affected",
              "version": "f1304d4420777f82a1d844c606db3d9eca841765",
              "versionType": "git"
            },
            {
              "lessThan": "4c324085062919d4e21c69e5e78456dcec0052fe",
              "status": "affected",
              "version": "f1304d4420777f82a1d844c606db3d9eca841765",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufs-mcq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()\n\nA race can occur between the MCQ completion path and the abort handler:\nonce a request completes, __blk_mq_free_request() sets rq-\u003emq_hctx to\nNULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in\nufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is\ndereferenced, the kernel will crash.\n\nAdd a NULL check for the returned hwq pointer. If hwq is NULL, log an\nerror and return FAILED, preventing a potential NULL-pointer\ndereference.  As suggested by Bart, the ufshcd_cmd_inflight() check is\nremoved.\n\nThis is similar to the fix in commit 74736103fb41 (\"scsi: ufs: core: Fix\nufshcd_abort_one racing issue\").\n\nThis is found by our static analysis tool KNighter."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:15:55.779Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6979fabe812a168d5053e5a41d5a2e9b8afd7bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d002f591486f5ef4bc02eb02025a53f931f0eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/47eec518aef3814f64a5da43df81bdd74d8c0041"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c324085062919d4e21c69e5e78456dcec0052fe"
        }
      ],
      "title": "scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37828",
    "datePublished": "2025-05-08T06:26:20.135Z",
    "dateReserved": "2025-04-16T04:51:23.950Z",
    "dateUpdated": "2026-05-11T21:15:55.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37828",
      "date": "2026-07-18",
      "epss": "0.00154",
      "percentile": "0.04987"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:08:50.000Z",
      "cve": "CVE-2025-37828",
      "id": "msrc_CVE-2025-37828",
      "initial_release_date": "2025-05-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37828.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37828\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-08T07:15:54.033\",\"lastModified\":\"2026-06-17T09:15:31.317\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()\\n\\nA race can occur between the MCQ completion path and the abort handler:\\nonce a request completes, __blk_mq_free_request() sets rq-\u003emq_hctx to\\nNULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in\\nufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is\\ndereferenced, the kernel will crash.\\n\\nAdd a NULL check for the returned hwq pointer. If hwq is NULL, log an\\nerror and return FAILED, preventing a potential NULL-pointer\\ndereference.  As suggested by Bart, the ufshcd_cmd_inflight() check is\\nremoved.\\n\\nThis is similar to the fix in commit 74736103fb41 (\\\"scsi: ufs: core: Fix\\nufshcd_abort_one racing issue\\\").\\n\\nThis is found by our static analysis tool KNighter.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: ufs: mcq: Agregar comprobaci\u00f3n NULL en ufshcd_mcq_abort() Puede ocurrir una ejecuci\u00f3n entre la ruta de finalizaci\u00f3n de MCQ y el controlador de aborto: una vez que se completa una solicitud, __blk_mq_free_request() establece rq-\u0026gt;mq_hctx en NULL, lo que significa que la llamada ufshcd_mcq_req_to_hwq() posterior en ufshcd_mcq_abort() puede devolver un puntero NULL. Si se desreferencia este puntero NULL, el kernel se bloquear\u00e1. Agregue una comprobaci\u00f3n NULL para el puntero hwq devuelto. Si hwq es NULL, registre un error y devuelva FAILED, lo que evita una posible desreferencia de puntero NULL. Como sugiri\u00f3 Bart, se elimina la comprobaci\u00f3n ufshcd_cmd_inflight(). Esto es similar a la correcci\u00f3n en el commit 74736103fb41 (\\\"scsi: ufs: core: Fix ufshcd_abort_one racing issue\\\"). Esta correcci\u00f3n la encontr\u00f3 nuestra herramienta de an\u00e1lisis est\u00e1tico Knighter.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/ufs/core/ufs-mcq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f1304d4420777f82a1d844c606db3d9eca841765\",\"lessThan\":\"d6979fabe812a168d5053e5a41d5a2e9b8afd7bf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f1304d4420777f82a1d844c606db3d9eca841765\",\"lessThan\":\"7d002f591486f5ef4bc02eb02025a53f931f0eb5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f1304d4420777f82a1d844c606db3d9eca841765\",\"lessThan\":\"47eec518aef3814f64a5da43df81bdd74d8c0041\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f1304d4420777f82a1d844c606db3d9eca841765\",\"lessThan\":\"4c324085062919d4e21c69e5e78456dcec0052fe\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/ufs/core/ufs-mcq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.89\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.26\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.5\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.89\",\"matchCriteriaId\":\"A918024A-FC62-44FA-8BDE-BC07EDE32890\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.26\",\"matchCriteriaId\":\"22F52099-F422-4D19-8283-45F9F9BF4392\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.5\",\"matchCriteriaId\":\"6B25CA7E-4CD0-46DB-B4EF-13A3516071FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/47eec518aef3814f64a5da43df81bdd74d8c0041\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c324085062919d4e21c69e5e78456dcec0052fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d002f591486f5ef4bc02eb02025a53f931f0eb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d6979fabe812a168d5053e5a41d5a2e9b8afd7bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T00:07:48+00:00",
      "cve": "CVE-2025-37828",
      "id": "CVE-2025-37828",
      "initial_release_date": "2025-05-08T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37828.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.