CVE-2026-80690

A flaw was found in the Linux kernel's SCSI Universal Flash Storage (UFS) core. When the ufshcd_alloc_host() function fails to initialize the hba->rpmbs list, it can lead to a null pointer dereference during device teardown. This vulnerability could allow a local attacker to cause a system crash, resulting in a Denial of Service (DoS).

A moderate-impact NULL pointer dereference flaw was found in the Linux kernel's SCSI Universal Flash Storage (UFS) core. The hba->rpmbs list is not initialized in ufshcd_alloc_host(), so when ufs_rpmb_probe() fails, the device teardown path dereferences the uninitialized list, causing a kernel panic. A local attacker could use this flaw to crash the system, resulting in a denial of service. Red Hat Product Security rates this issue with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code, introduced in upstream kernel version 6.19, is not present in any shipped Red Hat Enterprise Linux kernel or kernel-rt packages or in the Red Hat In-Vehicle OS kernel builds. All Red Hat products are therefore not affected by this flaw, and no action is required for Red Hat customers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.