CVE-2026-43275

A flaw was found in the Linux kernel's Universal Flash Storage (UFS) core driver. A race condition can occur during system suspend when the runtime power management (RPM) level is set to zero. This allows the driver to attempt to access the host controller after the system has entered a deep power-down state, leading to a system crash.

This vulnerability is rated as Moderate impact because triggering the denial-of-service condition requires local execution privileges on systems equipped with Universal Flash Storage controllers during power-state transitions. Standard enterprise server deployments typically lack UFS devices and do not utilize runtime power management level zero during suspend routines, limiting realistic exposure primarily to specialized embedded or automotive environments. Even where relevant hardware is present, exploitation is constrained to inducing a kernel crash, with no risk of privilege escalation or data confidentiality compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.