Description

In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TP_printk() The trace events in drivers/ufs/core/ufs_trace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TP_printk() the printing of the dev_name from the ring buffer was converted to using the dev dereferenced pointer from the hba saved pointer. This is not allowed as the TP_printk() is executed at the time the trace event is read from /sys/kernel/tracing/trace file. That can happen literally, seconds, minutes, hours, weeks, days, or even months later! There is no guarantee that the hba pointer will still exist by the time it is dereferenced when the "trace" file is read. Instead, save the device name from the hba pointer at the time the tracepoint is called and place it into the ring buffer event. Then the TP_printk() can read the name directly from the ring buffer and remove the possibility that it will read a freed pointer and crash the kernel. This was detected when testing the trace event code that looks for TP_printk() parameters doing illegal derferences[1] [1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:51.290Z",
  "pubdate": "2026-08-28T08:16:51.290Z",
  "executiveSummary": "This vulnerability involves a Use-After-Free (UAF) condition within the Linux kernel UFS (Universal Flash Storage) core trace subsystem.\nThe flaw originates from improper handling of pointer dereferences during tracepoint output execution, specifically within TP_printk().\nThe vulnerability allows for potential kernel memory corruption or system crashes when the trace buffer is read, as tracepoints attempt to access pointers that may have been freed or reallocated long after the trace event was captured.\nThe risk is categorized as critical for kernel stability, as it permits an attacker or a system event to trigger a kernel-level panic.\nExploitation requires the ability to trigger UFS trace events and subsequently access the trace output mechanism, though the primary impact is often a denial-of-service via system instability or potential arbitrary code execution if the memory state is manipulated at the time of the dangling pointer dereference.",
  "technicalDetails": "The root cause of this vulnerability lies in the asynchronous nature of Linux kernel tracepoints. Tracepoints in 'drivers/ufs/core/ufs_trace.h' were improperly implemented to store a pointer to the 'hba' (Host Bus Adapter) structure within the ring buffer.\nWhen a trace event is recorded, the kernel captures the 'hba' pointer address. However, the TP_printk() macro, which formats and prints the event, is executed later—at the time a user reads the trace output from '/sys/kernel/tracing/trace'.\nBecause the 'hba' structure may be deallocated or the memory remapped by the kernel long before the trace file is read, the dereferencing of the 'hba' pointer within TP_printk() constitutes a classic Use-After-Free condition.\nThe attack flow proceeds as follows: 1) An attacker triggers UFS operations that generate trace events. 2) The kernel stores the 'hba' memory address in the ring buffer. 3) The 'hba' object is freed due to device removal, driver unload, or power management transitions. 4) The attacker or a monitoring process attempts to read the contents of '/sys/kernel/tracing/trace'. 5) Upon reading, the kernel executes TP_printk(), which attempts to dereference the stale 'hba' pointer to resolve the 'dev_name'.\nThe resulting memory access attempts to read from a stale or recycled memory address. If the memory has been reallocated to another kernel subsystem, the trace output will contain corrupted data. If the memory is unmapped, the kernel will trigger a page fault, leading to a kernel panic (Denial of Service).\nThe vulnerability is essentially an architectural design flaw in how trace metadata is captured versus when it is consumed. By storing the pointer rather than the data (the device name) at the time of the event, the developers introduced a race condition that is inherently tied to the lifecycle of the 'hba' object.\nRemediation requires shifting the data capture logic so that static, immutable information—specifically the device name string—is copied into the trace ring buffer at the moment the tracepoint is triggered, rather than deferring the resolution of that string until the output is requested.\nThis prevents the trace subsystem from having any dependencies on the persistence of the 'hba' object, thereby neutralizing the UAF vector."
}