Linux Kernel up to 7.2.5 UFS Core ufshcd_tx_eqtr deadlock

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 7.2.5. Impacted is the function ufshcd_tx_eqtr of the component UFS Core. Executing a manipulation can lead to deadlock. This vulnerability is registered as CVE-2026-93057. The attack needs to be launched locally. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 7.2.5. This vulnerability affects the function ufshcd_tx_eqtr of the component UFS Core. The manipulation with an unknown input leads to a deadlock vulnerability. The CWE definition for the vulnerability is CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock. Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the TX EQTR call tree, including: - params->eqtr_record in ufshcd_tx_eqtr() - eqtr_data in __ufshcd_tx_eqtr() - params in ufs_qcom_get_rx_fom() This is preferred over tagging individual call sites with GFP_NOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint. [mkp: fix label as suggested by Bart]

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-93057 since 09/17/2026. The exploitation appears to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch a28a7d9b3bb116da788ae492c90465ec1a7fa6e8/760fc6f0e25a72832c2fcf37ecf5f1b770ec8374 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion