CVE-2026-92477

A flaw was found in the Linux kernel, specifically within the scsi: ufs: debugfs component. The ufs_saved_err_write() function copies user-provided input into a stack buffer without ensuring sufficient space for a string terminator. If the input completely fills the buffer, it overwrites the terminator, leading to a buffer overflow. This memory corruption could potentially result in a denial of service.

This vulnerability is rated as having a Moderate impact for Red Hat products because triggering it requires local write access to debugfs on systems equipped with Universal Flash Storage (UFS) hardware, limiting the blast radius to a local denial-of-service condition. Debugfs is restricted to privileged administrators by default on standard installations, substantially reducing exposure. Additionally, older enterprise releases, including Red Hat Enterprise Linux 8 and 9, lack the vulnerable code introduced in upstream kernel 5.16.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.