Critical Vulnerability in Linux Kernel: UFS Driver Programming Error
Summary
CVE-2025-39788: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, supporting a wide range of devices and architectures. This vulnerability affects the UFS (Universal Flash Storage) driver, specifically in the programming of the HCI_UTRL_NEXUS_TYPE, which is crucial for managing data transfers in devices like the Google gs101.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the UFS driver related to the programming of the HCI_UTRL_NEXUS_TYPE. The issue arises from incorrect handling of the number of UTP transfer request slots (nutrs), which is set to 32 for the Google gs101. The driver mistakenly programs the UTRL_NEXUS_TYPE as 0 due to an improper shift operation, leading to undefined behavior. This can result in data transfer errors and potential system instability. The vulnerability is characterized by a UBSAN shift warning, indicating that the shift exponent exceeds the width of the type, which can lead to unpredictable outcomes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The vulnerability CVE-2025-39788 in the Linux kernel's UFS driver poses a significant risk due to improper programming of the HCI_UTRL_NEXUS_TYPE. Users are advised to update their systems to the patched version to mitigate potential risks. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39788 is a vulnerability in the Linux kernel's UFS driver that affects the programming of the HCI_UTRL_NEXUS_TYPE, potentially leading to data transfer errors.
This vulnerability can cause undefined behavior during data transfers, leading to system instability and potential data loss.
Yes, all versions of the Linux kernel from Debian 11 to Debian 14 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
While there are no specific workarounds, it is recommended to monitor your system for any unusual behavior and apply the patch as soon as it is available.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
