CVE-2026-92480 scsi: ufs: core: Validate string descriptors
A buffer overread in the Linux kernel UFS driver allows attackers to read memory or cause a crash via malformed string descriptors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92480?
CVE-2026-92480 is a memory corruption vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Validate string descriptors
The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer.
Validate that the payload has an even byte count, pass a code-unit count to the converter, and allocate sufficient UTF-8 output space.
The raw string buffer starts after the descriptor header but its size is bLength. Copying bLength bytes from that pointer can read beyond the response buffer.
Allocate a zeroed bLength-sized buffer and copy only the UTF-16 payload. This preserves the raw buffer size consumed by the RPMB device-ID ABI while avoiding the overread.
Which versions are affected by CVE-2026-92480?
How do I fix CVE-2026-92480?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-92480 being exploited?
There is no known exploitation of CVE-2026-92480 in the wild and no public exploit code.
Sources
Also known as AZL-102365, BELL-CVE-2026-92480, DEBIAN-CVE-2026-92480, GHSA-m5gj-j8cw-f6g4, UBUNTU-CVE-2026-92480.