CVE-2026-92479 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers responsible for maintaining and securing Linux-based systems should assess exposure and prioritize patching for this vulnerability.

Why it matters

This vulnerability in the Linux kernel's SCSI UFS subsystem can cause a NULL CQE dereference when reporting invalid tags, potentially leading to errors. Defenders should prioritize verifying and applying patches for affected Linux kernel versions.

• Verification of Linux kernel versions is necessary to determine potential exposure
• Applying patches or updates from Linux is required to address the vulnerability
• Monitoring system logs for warning messages related to invalid tags in the SCSI UFS subsystem is recommended

Technical summary

The Linux kernel's SCSI UFS subsystem has a vulnerability that can cause a NULL CQE dereference when reporting invalid tags. This occurs in the single-doorbell completion path when ufshcd_compl_one_cqe() is called with a NULL CQE. The warning message attempts to dereference the CQE, which can lead to errors. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those versions identified as vulnerable in the source metadata. The official CVE Program record and NIST NVD detail page offer additional information on the vulnerability.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those versions identified as vulnerable in the source metadata.

Recommended defensive actions

• Verify Linux kernel versions for potential exposure based on provided version information
• Apply patches or updates from Linux to address the vulnerability
• Monitor system logs for warning messages related to invalid tags in the SCSI UFS subsystem
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and associated source metadata provide details on the vulnerability, including affected Linux kernel versions and links to relevant source references. The single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. Defenders should verify Linux kernel versions for potential exposure based on provided version information. The official CVE Program record and NIST NVD detail page offer additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.