CVE-2025-39674 scsi: ufs: ufs-qcom: Fix ESI null pointer dereference
A null pointer dereference in the Linux kernel UFS driver causes a crash when Enhanced System Interrupt allocation fails, requiring a patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39674?
CVE-2025-39674 is a medium-severity vulnerability in Linux kernel, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: ufs-qcom: Fix ESI null pointer dereference
ESI/MSI is a performance optimization feature that provides dedicated interrupts per MCQ hardware queue. This is optional feature and UFS MCQ should work with and without ESI feature.
Commit e46a28cea29a ("scsi: ufs: qcom: Remove the MSI descriptor abuse") brings a regression in ESI (Enhanced System Interrupt) configuration that causes a null pointer dereference when Platform MSI allocation fails.
The issue occurs in when platform_device_msi_init_and_alloc_irqs() in ufs_qcom_config_esi() fails (returns -EINVAL) but the current code uses __free() macro for automatic cleanup free MSI resources that were never successfully allocated.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
Call trace: mutex_lock+0xc/0x54 (P) platform_device_msi_free_irqs_all+0x1c/0x40 ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom] ufshcd_config_mcq+0x28/0x104 ufshcd_init+0xa3c/0xf40 ufshcd_pltfrm_init+0x504/0x7d4 ufs_qcom_probe+0x20/0x58 [ufs_qcom]
Fix by restructuring the ESI configuration to try MSI allocation first, before any other resource allocation and instead use explicit cleanup instead of __free() macro to avoid cleanup of unallocated resources.
Tested on SM8750 platform with MCQ enabled, both with and without Platform ESI support.
Weakness: CWE-476
Which versions are affected by CVE-2025-39674?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39674?
Apply the vendor's patch.
Is CVE-2025-39674 being exploited?
There is no known exploitation of CVE-2025-39674 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39674, DEBIAN-CVE-2025-39674, GHSA-mg6h-9rrq-3f7m, UBUNTU-CVE-2025-39674.