GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-41053 (GCVE-0-2024-41053)

Vulnerability from cvelistv5 – Published: 2024-07-29 14:32 – Updated: 2026-05-23 15:51
VLAI
Title
scsi: ufs: core: Fix ufshcd_abort_one racing issue
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcd_abort_one racing issue When ufshcd_abort_one is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by ISR. Return success when request is completed by ISR because ufshcd_abort_one does not need to do anything. The racing flow is: Thread A ufshcd_err_handler step 1 ... ufshcd_abort_one ufshcd_try_to_abort_task ufshcd_cmd_inflight(true) step 3 ufshcd_mcq_req_to_hwq blk_mq_unique_tag rq->mq_hctx->queue_num step 5 Thread B ufs_mtk_mcq_intr(cq complete ISR) step 2 scsi_done ... __blk_mq_free_request rq->mq_hctx = NULL; step 4 Below is KE back trace. ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device. ufshcd_try_to_abort_task: cmd at tag=41 is cleared. Aborting tag 41 / CDB 0x28 succeeded Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194 pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14 lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise] do_mem_abort+0x58/0x118 el1_abort+0x3c/0x5c el1h_64_sync_handler+0x54/0x90 el1h_64_sync+0x68/0x6c blk_mq_unique_tag+0x8/0x14 ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise] process_one_work+0x208/0x4fc worker_thread+0x228/0x438 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:22 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ff7699d3620763b0dfe2ff93df4528880bf903a8 , < c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0 (git)
Affected: 93e6c0e19d5bb12b49534a411c85e21d333731fa , < b5a6ac887256762758bfe7f2918cb0233aa544f4 (git)
Affected: 93e6c0e19d5bb12b49534a411c85e21d333731fa , < 74736103fb4123c71bf11fb7a6abe7c884c5269e (git)
Affected: 6.6.5 , < 6.6.41 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.6.41 , ≤ 6.6.* (semver)
Unaffected: 6.9.10 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:52.306Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41053",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:22:35.119070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:01.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0",
              "status": "affected",
              "version": "ff7699d3620763b0dfe2ff93df4528880bf903a8",
              "versionType": "git"
            },
            {
              "lessThan": "b5a6ac887256762758bfe7f2918cb0233aa544f4",
              "status": "affected",
              "version": "93e6c0e19d5bb12b49534a411c85e21d333731fa",
              "versionType": "git"
            },
            {
              "lessThan": "74736103fb4123c71bf11fb7a6abe7c884c5269e",
              "status": "affected",
              "version": "93e6c0e19d5bb12b49534a411c85e21d333731fa",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.41",
              "status": "affected",
              "version": "6.6.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.41",
                  "versionStartIncluding": "6.6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix ufshcd_abort_one racing issue\n\nWhen ufshcd_abort_one is racing with the completion ISR, the completed tag\nof the request\u0027s mq_hctx pointer will be set to NULL by ISR.  Return\nsuccess when request is completed by ISR because ufshcd_abort_one does not\nneed to do anything.\n\nThe racing flow is:\n\nThread A\nufshcd_err_handler\t\t\t\t\tstep 1\n\t...\n\tufshcd_abort_one\n\t\tufshcd_try_to_abort_task\n\t\t\tufshcd_cmd_inflight(true)\tstep 3\n\t\tufshcd_mcq_req_to_hwq\n\t\t\tblk_mq_unique_tag\n\t\t\t\trq-\u003emq_hctx-\u003equeue_num\tstep 5\n\nThread B\nufs_mtk_mcq_intr(cq complete ISR)\t\t\tstep 2\n\tscsi_done\n\t\t...\n\t\t__blk_mq_free_request\n\t\t\trq-\u003emq_hctx = NULL;\t\tstep 4\n\nBelow is KE back trace.\n  ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.\n  ufshcd_try_to_abort_task: cmd at tag=41 is cleared.\n  Aborting tag 41 / CDB 0x28 succeeded\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194\n  pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14\n  lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]\n   do_mem_abort+0x58/0x118\n   el1_abort+0x3c/0x5c\n   el1h_64_sync_handler+0x54/0x90\n   el1h_64_sync+0x68/0x6c\n   blk_mq_unique_tag+0x8/0x14\n   ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]\n   process_one_work+0x208/0x4fc\n   worker_thread+0x228/0x438\n   kthread+0x104/0x1d4\n   ret_from_fork+0x10/0x20"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:51:47.026Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e"
        }
      ],
      "title": "scsi: ufs: core: Fix ufshcd_abort_one racing issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41053",
    "datePublished": "2024-07-29T14:32:08.958Z",
    "dateReserved": "2024-07-12T12:17:45.626Z",
    "dateUpdated": "2026-05-23T15:51:47.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41053",
      "date": "2026-09-16",
      "epss": "0.00291",
      "percentile": "0.21693"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6.5\", \"versionEndExcluding\": \"6.6.41\", \"matchCriteriaId\": \"D801CC48-8332-42BC-BE0D-DA5A5C2D8FF5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.10\", \"matchCriteriaId\": \"AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: ufs: core: Fix ufshcd_abort_one racing issue\\n\\nWhen ufshcd_abort_one is racing with the completion ISR, the completed tag\\nof the request\u0027s mq_hctx pointer will be set to NULL by ISR.  Return\\nsuccess when request is completed by ISR because ufshcd_abort_one does not\\nneed to do anything.\\n\\nThe racing flow is:\\n\\nThread A\\nufshcd_err_handler\\t\\t\\t\\t\\tstep 1\\n\\t...\\n\\tufshcd_abort_one\\n\\t\\tufshcd_try_to_abort_task\\n\\t\\t\\tufshcd_cmd_inflight(true)\\tstep 3\\n\\t\\tufshcd_mcq_req_to_hwq\\n\\t\\t\\tblk_mq_unique_tag\\n\\t\\t\\t\\trq-\u003emq_hctx-\u003equeue_num\\tstep 5\\n\\nThread B\\nufs_mtk_mcq_intr(cq complete ISR)\\t\\t\\tstep 2\\n\\tscsi_done\\n\\t\\t...\\n\\t\\t__blk_mq_free_request\\n\\t\\t\\trq-\u003emq_hctx = NULL;\\t\\tstep 4\\n\\nBelow is KE back trace.\\n  ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.\\n  ufshcd_try_to_abort_task: cmd at tag=41 is cleared.\\n  Aborting tag 41 / CDB 0x28 succeeded\\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194\\n  pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14\\n  lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]\\n   do_mem_abort+0x58/0x118\\n   el1_abort+0x3c/0x5c\\n   el1h_64_sync_handler+0x54/0x90\\n   el1h_64_sync+0x68/0x6c\\n   blk_mq_unique_tag+0x8/0x14\\n   ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]\\n   process_one_work+0x208/0x4fc\\n   worker_thread+0x228/0x438\\n   kthread+0x104/0x1d4\\n   ret_from_fork+0x10/0x20\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: scsi: ufs: core: solucione el problema de ejecuci\\u00f3n de ufshcd_abort_one Cuando ufshcd_abort_one se ejecuta con el ISR de finalizaci\\u00f3n, ISR establecer\\u00e1 la etiqueta completada del puntero mq_hctx de la solicitud en NULL. Devuelve el \\u00e9xito cuando ISR completa la solicitud porque ufshcd_abort_one no necesita hacer nada. El flujo de ejecucuones es: Hilo A ufshcd_err_handler paso 1 ... ufshcd_abort_one ufshcd_try_to_abort_task ufshcd_cmd_inflight(true) paso 3 ufshcd_mcq_req_to_hwq blk_mq_unique_tag rq-\u0026gt;mq_hctx-\u0026gt;queue_num paso 5 Hilo B (cq completar ISR) paso 2 scsi_done... __blk_mq_free_request rq-\u0026gt; mq_hctx = NULO; paso 4 A continuaci\\u00f3n se muestra el seguimiento de KE. ufshcd_try_to_abort_task: cmd en la etiqueta 41 no est\\u00e1 pendiente en el dispositivo. ufshcd_try_to_abort_task: cmd en la etiqueta = 41 se borra. Anulaci\\u00f3n de la etiqueta 41 / CDB 0x28 exitosa No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\\u00f3n virtual 0000000000000194 pc: [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14 lr: [0xffffffddd6155b84] x1c/0x40 [ufs_mediatek_mod_ise] do_mem_abort+0x58/0x118 el1_abort+0x3c/ 0x5c el1h_64_sync_handler+0x54/0x90 el1h_64_sync+0x68/0x6c blk_mq_unique_tag+0x8/0x14 ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise] Process_one_work+0x208/0x4fc trabajador_thread+0x228/0 x438 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20\"}]",
      "id": "CVE-2024-41053",
      "lastModified": "2024-11-21T09:32:08.850",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-29T15:15:13.473",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:55:29.000Z",
      "cve": "CVE-2024-41053",
      "id": "msrc_CVE-2024-41053",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: ufs: core: Fix ufshcd_abort_one racing issue",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-41053.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41053\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:13.473\",\"lastModified\":\"2026-06-17T07:47:10.603\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: ufs: core: Fix ufshcd_abort_one racing issue\\n\\nWhen ufshcd_abort_one is racing with the completion ISR, the completed tag\\nof the request\u0027s mq_hctx pointer will be set to NULL by ISR.  Return\\nsuccess when request is completed by ISR because ufshcd_abort_one does not\\nneed to do anything.\\n\\nThe racing flow is:\\n\\nThread A\\nufshcd_err_handler\\t\\t\\t\\t\\tstep 1\\n\\t...\\n\\tufshcd_abort_one\\n\\t\\tufshcd_try_to_abort_task\\n\\t\\t\\tufshcd_cmd_inflight(true)\\tstep 3\\n\\t\\tufshcd_mcq_req_to_hwq\\n\\t\\t\\tblk_mq_unique_tag\\n\\t\\t\\t\\trq-\u003emq_hctx-\u003equeue_num\\tstep 5\\n\\nThread B\\nufs_mtk_mcq_intr(cq complete ISR)\\t\\t\\tstep 2\\n\\tscsi_done\\n\\t\\t...\\n\\t\\t__blk_mq_free_request\\n\\t\\t\\trq-\u003emq_hctx = NULL;\\t\\tstep 4\\n\\nBelow is KE back trace.\\n  ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.\\n  ufshcd_try_to_abort_task: cmd at tag=41 is cleared.\\n  Aborting tag 41 / CDB 0x28 succeeded\\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194\\n  pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14\\n  lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]\\n   do_mem_abort+0x58/0x118\\n   el1_abort+0x3c/0x5c\\n   el1h_64_sync_handler+0x54/0x90\\n   el1h_64_sync+0x68/0x6c\\n   blk_mq_unique_tag+0x8/0x14\\n   ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]\\n   process_one_work+0x208/0x4fc\\n   worker_thread+0x228/0x438\\n   kthread+0x104/0x1d4\\n   ret_from_fork+0x10/0x20\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: scsi: ufs: core: solucione el problema de ejecuci\u00f3n de ufshcd_abort_one Cuando ufshcd_abort_one se ejecuta con el ISR de finalizaci\u00f3n, ISR establecer\u00e1 la etiqueta completada del puntero mq_hctx de la solicitud en NULL. Devuelve el \u00e9xito cuando ISR completa la solicitud porque ufshcd_abort_one no necesita hacer nada. El flujo de ejecucuones es: Hilo A ufshcd_err_handler paso 1 ... ufshcd_abort_one ufshcd_try_to_abort_task ufshcd_cmd_inflight(true) paso 3 ufshcd_mcq_req_to_hwq blk_mq_unique_tag rq-\u0026gt;mq_hctx-\u0026gt;queue_num paso 5 Hilo B (cq completar ISR) paso 2 scsi_done... __blk_mq_free_request rq-\u0026gt; mq_hctx = NULO; paso 4 A continuaci\u00f3n se muestra el seguimiento de KE. ufshcd_try_to_abort_task: cmd en la etiqueta 41 no est\u00e1 pendiente en el dispositivo. ufshcd_try_to_abort_task: cmd en la etiqueta = 41 se borra. Anulaci\u00f3n de la etiqueta 41 / CDB 0x28 exitosa No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000194 pc: [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14 lr: [0xffffffddd6155b84] x1c/0x40 [ufs_mediatek_mod_ise] do_mem_abort+0x58/0x118 el1_abort+0x3c/ 0x5c el1h_64_sync_handler+0x54/0x90 el1h_64_sync+0x68/0x6c blk_mq_unique_tag+0x8/0x14 ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise] Process_one_work+0x208/0x4fc trabajador_thread+0x228/0 x438 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/ufs/core/ufshcd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ff7699d3620763b0dfe2ff93df4528880bf903a8\",\"lessThan\":\"c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93e6c0e19d5bb12b49534a411c85e21d333731fa\",\"lessThan\":\"b5a6ac887256762758bfe7f2918cb0233aa544f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93e6c0e19d5bb12b49534a411c85e21d333731fa\",\"lessThan\":\"74736103fb4123c71bf11fb7a6abe7c884c5269e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.5\",\"lessThan\":\"6.6.41\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/ufs/core/ufshcd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.41\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.10\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:22:35.119070Z\",\"id\":\"CVE-2024-41053\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.5\",\"versionEndExcluding\":\"6.6.41\",\"matchCriteriaId\":\"D801CC48-8332-42BC-BE0D-DA5A5C2D8FF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-26T02:17:05+00:00",
      "cve": "CVE-2024-41053",
      "id": "CVE-2024-41053",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: ufs: core: Fix ufshcd_abort_one racing issue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41053.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T14:01:32Z",
      "cve": "CVE-2024-41053",
      "id": "CVE-2024-41053",
      "initial_release_date": "2024-08-06T02:01:42Z",
      "product_status:known_not_affected": "379",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-41053",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-41053.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:52.306Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41053\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:22:35.119070Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.121Z\"}}], \"cna\": {\"title\": \"scsi: ufs: core: Fix ufshcd_abort_one racing issue\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ff7699d3620763b0dfe2ff93df4528880bf903a8\", \"lessThan\": \"c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93e6c0e19d5bb12b49534a411c85e21d333731fa\", \"lessThan\": \"b5a6ac887256762758bfe7f2918cb0233aa544f4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93e6c0e19d5bb12b49534a411c85e21d333731fa\", \"lessThan\": \"74736103fb4123c71bf11fb7a6abe7c884c5269e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.6.5\", \"lessThan\": \"6.6.41\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/ufs/core/ufshcd.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.41\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/ufs/core/ufshcd.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c3111b3cf3889bfa7b73ebff83d7397db9b7e5e0\"}, {\"url\": \"https://git.kernel.org/stable/c/b5a6ac887256762758bfe7f2918cb0233aa544f4\"}, {\"url\": \"https://git.kernel.org/stable/c/74736103fb4123c71bf11fb7a6abe7c884c5269e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: ufs: core: Fix ufshcd_abort_one racing issue\\n\\nWhen ufshcd_abort_one is racing with the completion ISR, the completed tag\\nof the request\u0027s mq_hctx pointer will be set to NULL by ISR.  Return\\nsuccess when request is completed by ISR because ufshcd_abort_one does not\\nneed to do anything.\\n\\nThe racing flow is:\\n\\nThread A\\nufshcd_err_handler\\t\\t\\t\\t\\tstep 1\\n\\t...\\n\\tufshcd_abort_one\\n\\t\\tufshcd_try_to_abort_task\\n\\t\\t\\tufshcd_cmd_inflight(true)\\tstep 3\\n\\t\\tufshcd_mcq_req_to_hwq\\n\\t\\t\\tblk_mq_unique_tag\\n\\t\\t\\t\\trq-\u003emq_hctx-\u003equeue_num\\tstep 5\\n\\nThread B\\nufs_mtk_mcq_intr(cq complete ISR)\\t\\t\\tstep 2\\n\\tscsi_done\\n\\t\\t...\\n\\t\\t__blk_mq_free_request\\n\\t\\t\\trq-\u003emq_hctx = NULL;\\t\\tstep 4\\n\\nBelow is KE back trace.\\n  ufshcd_try_to_abort_task: cmd at tag 41 not pending in the device.\\n  ufshcd_try_to_abort_task: cmd at tag=41 is cleared.\\n  Aborting tag 41 / CDB 0x28 succeeded\\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000194\\n  pc : [0xffffffddd7a79bf8] blk_mq_unique_tag+0x8/0x14\\n  lr : [0xffffffddd6155b84] ufshcd_mcq_req_to_hwq+0x1c/0x40 [ufs_mediatek_mod_ise]\\n   do_mem_abort+0x58/0x118\\n   el1_abort+0x3c/0x5c\\n   el1h_64_sync_handler+0x54/0x90\\n   el1h_64_sync+0x68/0x6c\\n   blk_mq_unique_tag+0x8/0x14\\n   ufshcd_err_handler+0xae4/0xfa8 [ufs_mediatek_mod_ise]\\n   process_one_work+0x208/0x4fc\\n   worker_thread+0x228/0x438\\n   kthread+0x104/0x1d4\\n   ret_from_fork+0x10/0x20\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.41\", \"versionStartIncluding\": \"6.6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.10\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:51:47.026Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41053\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:51:47.026Z\", \"dateReserved\": \"2024-07-12T12:17:45.626Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:32:08.958Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.