---
id: CVE-2026-92477
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: ufs: debugfs: Reserve space for a string terminator

  ufs_saved_err_write() copies user input into a zero-initialized stack
  buffer and passes it to kstrtoint()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: ufs: debugfs: Reserve space for a string terminator

  ufs_saved_err_write() copies user input into a zero-initialized stack
  buffer and passes it to kstrtoint(). A …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7340faae947400907e5e7581444712110d2811d5 <
    b43890843e834300f967c69e74c7c2eb22cb1664
  - >-
    Linux >= 7340faae947400907e5e7581444712110d2811d5 <
    587be18e0935632ebd367b0f89e37aa5762e400f
  - >-
    Linux >= 7340faae947400907e5e7581444712110d2811d5 <
    d223989e1a1edad217b673486b093bd157fb6c9a
  - >-
    Linux >= 7340faae947400907e5e7581444712110d2811d5 <
    cc92af8cc0e4dacd4375d34475141b0f1a70c09e
  - >-
    Linux >= 7340faae947400907e5e7581444712110d2811d5 <
    2b3fb5693c25c21741f357a8c9d0e1f19b7e368f
  - >-
    Linux >= 7340faae947400907e5e7581444712110d2811d5 <
    abd26e6b53c4169122d61fdd4cabe09bdd916aac
  - Linux 5.16
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:49.720'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92477'
references:
  - url: 'https://git.kernel.org/stable/c/2b3fb5693c25c21741f357a8c9d0e1f19b7e368f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/587be18e0935632ebd367b0f89e37aa5762e400f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/abd26e6b53c4169122d61fdd4cabe09bdd916aac'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b43890843e834300f967c69e74c7c2eb22cb1664'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cc92af8cc0e4dacd4375d34475141b0f1a70c09e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d223989e1a1edad217b673486b093bd157fb6c9a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.789Z'
epss: 0.00173
epssPercentile: 0.05843
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: debugfs: Reserve space for a string terminator

ufs_saved_err_write() copies user input into a zero-initialized stack
buffer and passes it to kstrtoint(). A write that fills the entire buffer
overwrites its only terminator.

Reject an input whose length leaves no room for the trailing NUL.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.