{"id":"DEBIAN-CVE-2026-43471","details":"In the Linux kernel, the following vulnerability has been resolved:  scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()  The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq-\u003eid.  This can happen if ufshcd_mcq_req_to_hwq() returns NULL.  This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash.  Kernel log excerpt: [\u003cffffffd5d192dc4c\u003e] notify_die+0x4c/0x8c [\u003cffffffd5d1814e58\u003e] __die+0x60/0xb0 [\u003cffffffd5d1814d64\u003e] die+0x4c/0xe0 [\u003cffffffd5d181575c\u003e] die_kernel_fault+0x74/0x88 [\u003cffffffd5d1864db4\u003e] __do_kernel_fault+0x314/0x318 [\u003cffffffd5d2a3cdf8\u003e] do_page_fault+0xa4/0x5f8 [\u003cffffffd5d2a3cd34\u003e] do_translation_fault+0x34/0x54 [\u003cffffffd5d1864524\u003e] do_mem_abort+0x50/0xa8 [\u003cffffffd5d2a297dc\u003e] el1_abort+0x3c/0x64 [\u003cffffffd5d2a29718\u003e] el1h_64_sync_handler+0x44/0xcc [\u003cffffffd5d181133c\u003e] el1h_64_sync+0x80/0x88 [\u003cffffffd5d255c1dc\u003e] ufshcd_add_command_trace+0x23c/0x320 [\u003cffffffd5d255bad8\u003e] ufshcd_compl_one_cqe+0xa4/0x404 [\u003cffffffd5d2572968\u003e] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [\u003cffffffd5d11c7460\u003e] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [\u003cffffffd5d19ab92c\u003e] __handle_irq_event_percpu+0xc8/0x348 [\u003cffffffd5d19abca8\u003e] handle_irq_event+0x3c/0xa8 [\u003cffffffd5d19b1f0c\u003e] handle_fasteoi_irq+0xf8/0x294 [\u003cffffffd5d19aa778\u003e] generic_handle_domain_irq+0x54/0x80 [\u003cffffffd5d18102bc\u003e] gic_handle_irq+0x1d4/0x330 [\u003cffffffd5d1838210\u003e] call_on_irq_stack+0x44/0x68 [\u003cffffffd5d183af30\u003e] do_interrupt_handler+0x78/0xd8 [\u003cffffffd5d2a29c00\u003e] el1_interrupt+0x48/0xa8 [\u003cffffffd5d2a29ba8\u003e] el1h_64_irq_handler+0x14/0x24 [\u003cffffffd5d18113c4\u003e] el1h_64_irq+0x80/0x88 [\u003cffffffd5d2527fb4\u003e] arch_local_irq_enable+0x4/0x1c [\u003cffffffd5d25282e4\u003e] cpuidle_enter+0x34/0x54 [\u003cffffffd5d195a678\u003e] do_idle+0x1dc/0x2f8 [\u003cffffffd5d195a7c4\u003e] cpu_startup_entry+0x30/0x3c [\u003cffffffd5d18155c4\u003e] secondary_start_kernel+0x134/0x1ac [\u003cffffffd5d18640bc\u003e] __secondary_switched+0xc4/0xcc","modified":"2026-08-27T23:06:06.320682430Z","published":"2026-05-08T15:17:00.193Z","upstream":["CVE-2026-43471"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-43471"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.85-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-43471.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.10-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-43471.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}