CVE-2026-92477

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator. Reject an input whose length leaves no room for the trailing NUL.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:49.720000

Last modified

2026-10-19 09:19:38.043000

View original CVE JSON

{
  "id": "CVE-2026-92477",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:49.720",
  "lastModified": "2026-10-19T09:19:38.043",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: debugfs: Reserve space for a string terminator\n\nufs_saved_err_write() copies user input into a zero-initialized stack\nbuffer and passes it to kstrtoint(). A write that fills the entire buffer\noverwrites its only terminator.\n\nReject an input whose length leaves no room for the trailing NUL."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/ufs/core/ufs-debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7340faae947400907e5e7581444712110d2811d5",
              "lessThan": "b43890843e834300f967c69e74c7c2eb22cb1664",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7340faae947400907e5e7581444712110d2811d5",
              "lessThan": "587be18e0935632ebd367b0f89e37aa5762e400f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7340faae947400907e5e7581444712110d2811d5",
              "lessThan": "d223989e1a1edad217b673486b093bd157fb6c9a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7340faae947400907e5e7581444712110d2811d5",
              "lessThan": "cc92af8cc0e4dacd4375d34475141b0f1a70c09e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7340faae947400907e5e7581444712110d2811d5",
              "lessThan": "2b3fb5693c25c21741f357a8c9d0e1f19b7e368f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7340faae947400907e5e7581444712110d2811d5",
              "lessThan": "abd26e6b53c4169122d61fdd4cabe09bdd916aac",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/ufs/core/ufs-debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2b3fb5693c25c21741f357a8c9d0e1f19b7e368f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/587be18e0935632ebd367b0f89e37aa5762e400f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/abd26e6b53c4169122d61fdd4cabe09bdd916aac",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b43890843e834300f967c69e74c7c2eb22cb1664",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc92af8cc0e4dacd4375d34475141b0f1a70c09e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d223989e1a1edad217b673486b093bd157fb6c9a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}