CVE-2026-92480

A flaw was found in the Linux kernel's SCSI Universal Flash Storage (UFS) core. This vulnerability arises from improper validation of string descriptors, which can lead to an out-of-bounds read when processing UTF-16 payloads. A local attacker or a malicious UFS device could exploit this to potentially disclose sensitive information or cause a denial of service (DoS).

This vulnerability is rated as Moderate severity because an attacker requires either local access or direct interaction with specialized Universal Flash Storage hardware to trigger an out-of-bounds memory read, restricting the impact primarily to a local denial of service. Standard enterprise server deployments running Red Hat Enterprise Linux rarely utilize UFS hardware, significantly lowering the practical risk in traditional data center environments. Furthermore, older enterprise platforms, including RHEL 8 and RHEL 9, do not include the vulnerable code path and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.