A critical vulnerability in the Linux kernel UFS trace subsystem allows a local authenticated attacker to trigger a kernel crash via an invalid pointer dereference.

The vulnerability resides in the UFS core tracing mechanism, where trace events incorrectly dereferenced pointers in TP_printk() that may no longer exist when the trace log is read. This occurs because the tracepoint executes at a later time than the event recording, allowing for a use-after-free condition if the underlying hba structure has been deallocated.

Successful exploitation of this vulnerability results in a kernel panic, leading to an immediate denial of service for the affected host. Given the CVSS score of 7.8, this poses a significant risk to system availability, particularly in environments utilizing UFS storage where local users possess sufficient privileges to interact with kernel tracing interfaces.

Immediate Action: Update the Linux kernel to version 6.18.40, 7.1.5, or 7.2, which contain the necessary fix to ensure device names are copied into the ring buffer at the time of the event.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or panic events, especially those originating from the UFS driver or trace subsystem.

Compensating Controls: Restrict access to kernel tracing interfaces, such as /sys/kernel/tracing/, to highly privileged administrative accounts to limit the attack surface for local users.

Public Exploit Available: No.

This vulnerability represents a significant stability risk for systems utilizing UFS storage. Administrators should prioritize patching the kernel to the recommended stable versions to prevent potential system instability. While exploitation requires local access, the nature of the flaw makes it a reliable method for crashing systems, necessitating timely remediation.