CVE-2026-43275

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43275", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.998Z", "datePublished": "2026-05-06T11:28:58.174Z", "dateUpdated": "2026-05-11T22:21:24.558Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:21:24.558Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Flush exception handling work when RPM level is zero\n\nEnsure that the exception event handling work is explicitly flushed during\nsuspend when the runtime power management level is set to UFS_PM_LVL_0.\n\nWhen the RPM level is zero, the device power mode and link state both\nremain active. Previously, the UFS core driver bypassed flushing exception\nevent handling jobs in this configuration. This created a race condition\nwhere the driver could attempt to access the host controller to handle an\nexception after the system had already entered a deep power-down state,\nresulting in a system crash.\n\nExplicitly flush this work and disable auto BKOPs before the suspend\ncallback proceeds. This guarantees that pending exception tasks complete\nand prevents illegal hardware access during the power-down sequence."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufshcd.c"], "versions": [{"version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "lessThan": "d5c3a1a13f97355c397f9439d79cb04b182958a3", "status": "affected", "versionType": "git"}, {"version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "lessThan": "5d186731bc335cc049d4e57ab9f563cfab95593e", "status": "affected", "versionType": "git"}, {"version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "lessThan": "aa8d68d97c7f0ef966e51afc17fdbdc372700edf", "status": "affected", "versionType": "git"}, {"version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "lessThan": "aac2fee7513dd25042a616f86a1469b4858d2c5c", "status": "affected", "versionType": "git"}, {"version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "lessThan": "78d8e2d6352e8317686ee3a44811ac14c415a57d", "status": "affected", "versionType": "git"}, {"version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "lessThan": "ab71c146c135f9af1614ef0fc29a0a3b84f1a373", "status": "affected", "versionType": "git"}, {"version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "lessThan": "f8ef441811ec413717f188f63d99182f30f0f08e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufshcd.c"], "versions": [{"version": "3.18", "status": "affected"}, {"version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.15.202"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.1.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.6.128"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d5c3a1a13f97355c397f9439d79cb04b182958a3"}, {"url": "https://git.kernel.org/stable/c/5d186731bc335cc049d4e57ab9f563cfab95593e"}, {"url": "https://git.kernel.org/stable/c/aa8d68d97c7f0ef966e51afc17fdbdc372700edf"}, {"url": "https://git.kernel.org/stable/c/aac2fee7513dd25042a616f86a1469b4858d2c5c"}, {"url": "https://git.kernel.org/stable/c/78d8e2d6352e8317686ee3a44811ac14c415a57d"}, {"url": "https://git.kernel.org/stable/c/ab71c146c135f9af1614ef0fc29a0a3b84f1a373"}, {"url": "https://git.kernel.org/stable/c/f8ef441811ec413717f188f63d99182f30f0f08e"}], "title": "scsi: ufs: core: Flush exception handling work when RPM level is zero", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/ufs/core/ufshcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d5c3a1a13f97355c397f9439d79cb04b182958a3", "status": "affected", "version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "versionType": "git"}, {"lessThan": "5d186731bc335cc049d4e57ab9f563cfab95593e", "status": "affected", "version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "versionType": "git"}, {"lessThan": "aa8d68d97c7f0ef966e51afc17fdbdc372700edf", "status": "affected", "version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "versionType": "git"}, {"lessThan": "aac2fee7513dd25042a616f86a1469b4858d2c5c", "status": "affected", "version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "versionType": "git"}, {"lessThan": "78d8e2d6352e8317686ee3a44811ac14c415a57d", "status": "affected", "version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "versionType": "git"}, {"lessThan": "ab71c146c135f9af1614ef0fc29a0a3b84f1a373", "status": "affected", "version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "versionType": "git"}, {"lessThan": "f8ef441811ec413717f188f63d99182f30f0f08e", "status": "affected", "version": "57d104c153d3d6d7bea60089e80f37501851ed2c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/ufs/core/ufshcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.18"}, {"lessThan": "3.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.202", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.165", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.128", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B0911717-6197-4D52-8E5A-CF01589FC143", "versionEndExcluding": "5.15.202", "versionStartIncluding": "3.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654", "versionEndExcluding": "6.1.165", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Flush exception handling work when RPM level is zero\n\nEnsure that the exception event handling work is explicitly flushed during\nsuspend when the runtime power management level is set to UFS_PM_LVL_0.\n\nWhen the RPM level is zero, the device power mode and link state both\nremain active. Previously, the UFS core driver bypassed flushing exception\nevent handling jobs in this configuration. This created a race condition\nwhere the driver could attempt to access the host controller to handle an\nexception after the system had already entered a deep power-down state,\nresulting in a system crash.\n\nExplicitly flush this work and disable auto BKOPs before the suspend\ncallback proceeds. This guarantees that pending exception tasks complete\nand prevents illegal hardware access during the power-down sequence."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: ufs: core: Vaciar el trabajo de manejo de excepciones cuando el nivel de RPM es cero\n\nAsegurar que el trabajo de manejo de eventos de excepci\u00f3n se vac\u00ede expl\u00edcitamente durante la suspensi\u00f3n cuando el nivel de gesti\u00f3n de energ\u00eda en tiempo de ejecuci\u00f3n se establece en UFS_PM_LVL_0.\n\nCuando el nivel de RPM es cero, tanto el modo de energ\u00eda del dispositivo como el estado del enlace permanecen activos. Anteriormente, el controlador UFS core omit\u00eda el vaciado de las tareas de manejo de eventos de excepci\u00f3n en esta configuraci\u00f3n. Esto creaba una condici\u00f3n de carrera donde el controlador pod\u00eda intentar acceder al controlador de host para manejar una excepci\u00f3n despu\u00e9s de que el sistema ya hab\u00eda entrado en un estado de apagado profundo, lo que resultaba en un fallo del sistema.\n\nVaciar expl\u00edcitamente este trabajo y deshabilitar los BKOPs autom\u00e1ticos antes de que la llamada de retorno de suspensi\u00f3n proceda. Esto garantiza que las tareas de excepci\u00f3n pendientes se completen y previene el acceso ilegal al hardware durante la secuencia de apagado."}], "id": "CVE-2026-43275", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-06T12:16:48.800", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d186731bc335cc049d4e57ab9f563cfab95593e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/78d8e2d6352e8317686ee3a44811ac14c415a57d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa8d68d97c7f0ef966e51afc17fdbdc372700edf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aac2fee7513dd25042a616f86a1469b4858d2c5c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ab71c146c135f9af1614ef0fc29a0a3b84f1a373"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5c3a1a13f97355c397f9439d79cb04b182958a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f8ef441811ec413717f188f63d99182f30f0f08e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: scsi: ufs: core: Flush exception handling work when RPM level is zero", "id": "2467079", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467079"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's Universal Flash Storage (UFS) core driver. A race condition can occur during system suspend when the runtime power management (RPM) level is set to zero. This allows the driver to attempt to access the host controller after the system has entered a deep power-down state, leading to a system crash."], "name": "CVE-2026-43275", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43275\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43275\nhttps://lore.kernel.org/linux-cve-announce/2026050612-CVE-2026-43275-41db@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57d104c153d3d6d7bea60089e80f37501851ed2c,d5c3a1a13f97355c397f9439d79cb04b182958a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57d104c153d3d6d7bea60089e80f37501851ed2c,5d186731bc335cc049d4e57ab9f563cfab95593e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57d104c153d3d6d7bea60089e80f37501851ed2c,aa8d68d97c7f0ef966e51afc17fdbdc372700edf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57d104c153d3d6d7bea60089e80f37501851ed2c,aac2fee7513dd25042a616f86a1469b4858d2c5c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57d104c153d3d6d7bea60089e80f37501851ed2c,78d8e2d6352e8317686ee3a44811ac14c415a57d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57d104c153d3d6d7bea60089e80f37501851ed2c,ab71c146c135f9af1614ef0fc29a0a3b84f1a373)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57d104c153d3d6d7bea60089e80f37501851ed2c,f8ef441811ec413717f188f63d99182f30f0f08e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.202,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.165,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.128,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T16:45:07.230128+00:00", "updated": "2026-05-08T21:00:10.215630+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}