{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()  The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq-\u003eid.  This can happen if ufshcd_mcq_req_to_hwq() returns NULL.  This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash.  Kernel log excerpt: [\u003cffffffd5d192dc4c\u003e] notify_die+0x4c/0x8c [\u003cffffffd5d1814e58\u003e] __die+0x60/0xb0 [\u003cffffffd5d1814d64\u003e] die+0x4c/0xe0 [\u003cffffffd5d181575c\u003e] die_kernel_fault+0x74/0x88 [\u003cffffffd5d1864db4\u003e] __do_kernel_fault+0x314/0x318 [\u003cffffffd5d2a3cdf8\u003e] do_page_fault+0xa4/0x5f8 [\u003cffffffd5d2a3cd34\u003e] do_translation_fault+0x34/0x54 [\u003cffffffd5d1864524\u003e] do_mem_abort+0x50/0xa8 [\u003cffffffd5d2a297dc\u003e] el1_abort+0x3c/0x64 [\u003cffffffd5d2a29718\u003e] el1h_64_sync_handler+0x44/0xcc [\u003cffffffd5d181133c\u003e] el1h_64_sync+0x80/0x88 [\u003cffffffd5d255c1dc\u003e] ufshcd_add_command_trace+0x23c/0x320 [\u003cffffffd5d255bad8\u003e] ufshcd_compl_one_cqe+0xa4/0x404 [\u003cffffffd5d2572968\u003e] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [\u003cffffffd5d11c7460\u003e] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [\u003cffffffd5d19ab92c\u003e] __handle_irq_event_percpu+0xc8/0x348 [\u003cffffffd5d19abca8\u003e] handle_irq_event+0x3c/0xa8 [\u003cffffffd5d19b1f0c\u003e] handle_fasteoi_irq+0xf8/0x294 [\u003cffffffd5d19aa778\u003e] generic_handle_domain_irq+0x54/0x80 [\u003cffffffd5d18102bc\u003e] gic_handle_irq+0x1d4/0x330 [\u003cffffffd5d1838210\u003e] call_on_irq_stack+0x44/0x68 [\u003cffffffd5d183af30\u003e] do_interrupt_handler+0x78/0xd8 [\u003cffffffd5d2a29c00\u003e] el1_interrupt+0x48/0xa8 [\u003cffffffd5d2a29ba8\u003e] el1h_64_irq_handler+0x14/0x24 [\u003cffffffd5d18113c4\u003e] el1h_64_irq+0x80/0x88 [\u003cffffffd5d2527fb4\u003e] arch_local_irq_enable+0x4/0x1c [\u003cffffffd5d25282e4\u003e] cpuidle_enter+0x34/0x54 [\u003cffffffd5d195a678\u003e] do_idle+0x1dc/0x2f8 [\u003cffffffd5d195a7c4\u003e] cpu_startup_entry+0x30/0x3c [\u003cffffffd5d18155c4\u003e] secondary_start_kernel+0x134/0x1ac [\u003cffffffd5d18640bc\u003e] __secondary_switched+0xc4/0xcc",
  "id": "DEBIAN-CVE-2026-43471",
  "modified": "2026-09-14T16:47:48.461042441Z",
  "published": "2026-05-08T15:17:00.193Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-43471"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-43471"
  ]
}