Skip to main content

Linux Kernel CVE-2026-43413

| EUVDEUVD-2026-28719 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-08 Linux GHSA-3crh-xxfm-7qqg
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to local shell
  2. Delivery
    Identify hisi_sas host in sysfs
  3. Exploit
    Write channel 1 scan trigger to /sys/class/scsi_host/hostN/scan
  4. Execution
    sas_user_scan() dereferences NULL pointer for channel 1
  5. Impact
    Kernel oops crashes system

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) the target system must be equipped with HiSilicon SAS v3 hardware with the hisi_sas_v3_hw and hisi_sas_main kernel modules loaded - systems without this hardware are unaffected regardless of kernel version; (2) the attacker must have a local authenticated account with write permission to the sysfs scan interface (/sys/class/scsi_host/hostN/scan), which corresponds to CVSS PR:L (low-privilege local user); (3) the running kernel must fall in the vulnerable version range (post-4.13, prior to 6.6.130/6.12.78/6.18.19/6.19.9/7.0). Limiting factors: no network exposure (AV:L), requires authenticated shell access, and hardware-specific - the vast majority of Linux deployments lack HiSilicon SAS controllers entirely. Remote exploitation is not possible.
Impact

Real-world risk is moderate-to-low outside of HiSilicon server environments. CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the local attack surface: exploiting this requires physical or SSH access to a machine running hisi_sas hardware with a user account holding at least shell access - not a typical internet-facing threat. EPSS at 0.02% (5th percentile) corroborates low exploitation probability. There is no CISA KEV listing and no POC identified at time of analysis. The impact is purely availability (kernel panic/crash), with no confidentiality or integrity risk. The primary risk group is operators of HiSilicon Kunpeng-based ARM64 servers (e.g., Huawei TaiShan) running unpatched kernels in the 4.13-6.x range. The narrow hardware dependency significantly limits blast radius compared to generic kernel CVEs.
Exploit ScenarioDerived

A local user with a shell on a HiSilicon ARM64 server (e.g., Huawei TaiShan 2280) writes a wildcard or multi-channel scan string such as '- 1 -' to /sys/class/scsi_host/hostN/scan. The kernel's sas_user_scan() processes channel 1, for which hisi_sas has no valid device structure, and dereferences a NULL pointer inside sas_find_dev_by_rphy(), triggering an immediate kernel oops and system crash. No public exploit code has been identified; the attack is trivially reproducible by anyone with shell access and knowledge of the sysfs scan interface.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 21, 2026

NULL pointer dereference in the Linux kernel's hisi_sas SCSI driver crashes systems when a local user triggers a host scan via sysfs. Authenticated local users with low privileges can write to the sysfs scan interface, causing kernel oops due to a channel iteration bug introduced in commit 37c4e72b0651 - the driver supports only one channel (channel 0) but its max_channel is set to 1, causing sas_user_scan() to attempt scanning channel 1 where no valid SAS device structure exists. The result is a denial-of-service via kernel NULL pointer dereference at sas_find_dev_by_rphy(). No public exploit or CISA KEV listing has been identified; EPSS is 0.02% (5th percentile), consistent with low-likelihood opportunistic exploitation.

RemediationAI

Upgrade to a patched kernel release: 6.6.x users should apply 6.6.130 or later; 6.12.x users should apply 6.12.78 or later; 6.18.x users should apply 6.18.19 or later; 6.19.x users should apply 6.19.9 or later; users on the 7.0 development series should apply the fix commit. Upstream patch commits are available at https://git.kernel.org/stable/c/70c78429ef383e35f9c58848994aeeac8083ae35, https://git.kernel.org/stable/c/40119a21d9769bf8fdab5c93c6c878296e628abf, https://git.kernel.org/stable/c/21a13db8d449b9c7eda4471da7f12417602dbbc7, https://git.kernel.org/stable/c/beadac156610a4f3bb15cb7bb4b07b6ac06f6567, and https://git.kernel.org/stable/c/8ddc0c26916574395447ebf4cff684314f6873a9. As a workaround on unpatched systems, restrict write access to the sysfs scan attribute (e.g., via filesystem permissions or SELinux/AppArmor policy denying writes to /sys/class/scsi_host/hostN/scan for unprivileged users) - note this may impact legitimate storage management tooling that relies on sysfs-triggered rescans.

Affected VersionsENISA

Linux patch: 6.12.78
Linux patch: 6.18.19
Linux e21fe3a52692f554efd67957c772c702de627a3a <70c78429ef383e35f9c58848994aeeac8083ae35
Linux e21fe3a52692f554efd67957c772c702de627a3a <21a13db8d449b9c7eda4471da7f12417602dbbc7
Linux patch: 6.19.9
Linux e21fe3a52692f554efd67957c772c702de627a3a <40119a21d9769bf8fdab5c93c6c878296e628abf
Linux 4.13
Linux e21fe3a52692f554efd67957c772c702de627a3a <beadac156610a4f3bb15cb7bb4b07b6ac06f6567
Linux patch: 6.6.130
Linux patch: 0
Linux e21fe3a52692f554efd67957c772c702de627a3a <8ddc0c26916574395447ebf4cff684314f6873a9
Linux patch: 7.0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the hisi_sas driver (Hisilicon SAS v3 HW), a SCSI-over-SAS subsystem component used in HiSilicon-based ARM64 servers (CPE: cpe:2.3:a:linux:linux). The root cause (CWE-476, NULL Pointer Dereference) is a logic mismatch: user_scan() calls the updated sas_user_scan() for channel 0, then iterates channels 1 through shost->max_channel via scsi_scan_host_selected(). Because hisi_sas is a single-channel controller, there is no SAS port or device structure for channel 1. When sas_user_scan() invokes sas_target_alloc() → sas_find_dev_by_rphy(), it dereferences a NULL pointer at virtual address 0x8b0, triggering an ARM64 DABT (Data Abort) level-0 translation fault. The offending call trace runs through kernfs_fop_write_iter → store_scan → sas_user_scan → scsi_scan_host_selected → sas_find_dev_by_rphy+0x44, confirming the sysfs write path as the trigger.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 21, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
May 08, 2026 - 16:18 EUVD
CVE Published
May 08, 2026 - 14:21 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

scsi: hisi_sas: Fix NULL pointer exception during user_scan()

user_scan() invokes updated sas_user_scan() for channel 0, and if successful, iteratively scans remaining channels (1 to shost->max_channel) via scsi_scan_host_selected() in commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"). However, hisi_sas supports only one channel, and the current value of max_channel is

  1. sas_user_scan() for channel 1 will trigger the following NULL pointer

exception:

[ 441.554662] Unable to handle kernel NULL pointer dereference at virtual address 00000000000008b0 [ 441.554699] Mem abort info: [ 441.554710] ESR = 0x0000000096000004 [ 441.554718] EC = 0x25: DABT (current EL), IL = 32 bits [ 441.554723] SET = 0, FnV = 0 [ 441.554726] EA = 0, S1PTW = 0 [ 441.554730] FSC = 0x04: level 0 translation fault [ 441.554735] Data abort info: [ 441.554737] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 441.554742] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 441.554747] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 441.554752] user pgtable: 4k pages, 48-bit VAs, pgdp=00000828377a6000 [ 441.554757] [00000000000008b0] pgd=0000000000000000, p4d=0000000000000000 [ 441.554769] Internal error: Oops: 0000000096000004 [#1] SMP [ 441.629589] Modules linked in: arm_spe_pmu arm_smmuv3_pmu tpm_tis_spi hisi_uncore_sllc_pmu hisi_uncore_pa_pmu hisi_uncore_l3c_pmu hisi_uncore_hha_pmu hisi_uncore_ddrc_pmu hisi_uncore_cpa_pmu hns3_pmu hisi_ptt hisi_pcie_pmu tpm_tis_core spidev spi_hisi_sfc_v3xx hisi_uncore_pmu spi_dw_mmio fuse hclge hclge_common hisi_sec2 hisi_hpre hisi_zip hisi_qm hns3 hisi_sas_v3_hw sm3_ce sbsa_gwdt hnae3 hisi_sas_main uacce hisi_dma i2c_hisi dm_mirror dm_region_hash dm_log dm_mod [ 441.670819] CPU: 46 UID: 0 PID: 6994 Comm: bash Kdump: loaded Not tainted 7.0.0-rc2+ #84 PREEMPT [ 441.691327] pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 441.698277] pc : sas_find_dev_by_rphy+0x44/0x118 [ 441.702896] lr : sas_find_dev_by_rphy+0x3c/0x118 [ 441.707502] sp : ffff80009abbba40 [ 441.710805] x29: ffff80009abbba40 x28: ffff082819a40008 x27: ffff082810c37c08 [ 441.717930] x26: ffff082810c37c28 x25: ffff082819a40290 x24: ffff082810c37c00 [ 441.725054] x23: 0000000000000000 x22: 0000000000000001 x21: ffff082819a40000 [ 441.732179] x20: ffff082819a40290 x19: 0000000000000000 x18: 0000000000000020 [ 441.739304] x17: 0000000000000000 x16: ffffb5dad6bda690 x15: 00000000ffffffff [ 441.746428] x14: ffff082814c3b26c x13: 00000000ffffffff x12: ffff082814c3b26a [ 441.753553] x11: 00000000000000c0 x10: 000000000000003a x9 : ffffb5dad5ea94f4 [ 441.760678] x8 : 000000000000003a x7 : ffff80009abbbab0 x6 : 0000000000000030 [ 441.767802] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 441.774926] x2 : ffff08280f35a300 x1 : ffffb5dad7127180 x0 : 0000000000000000 [ 441.782053] Call trace: [ 441.784488] sas_find_dev_by_rphy+0x44/0x118 (P) [ 441.789095] sas_target_alloc+0x24/0xb0 [ 441.792920] scsi_alloc_target+0x290/0x330 [ 441.797010] __scsi_scan_target+0x88/0x258 [ 441.801096] scsi_scan_channel+0x74/0xb8 [ 441.805008] scsi_scan_host_selected+0x170/0x188 [ 441.809615] sas_user_scan+0xfc/0x148 [ 441.813267] store_scan+0x10c/0x180 [ 441.816743] dev_attr_store+0x20/0x40 [ 441.820398] sysfs_kf_write+0x84/0xa8 [ 441.824054] kernfs_fop_write_iter+0x130/0x1c8 [ 441.828487] vfs_write+0x2c0/0x370 [ 441.831880] ksys_write+0x74/0x118 [ 441.835271] __arm64_sys_write+0x24/0x38 [ 441.839182] invoke_syscall+0x50/0x120 [ 441.842919] el0_svc_common.constprop.0+0xc8/0xf0 [ 441.847611] do_el0_svc+0x24/0x38 [ 441.850913] el0_svc+0x38/0x158 [ 441.854043] el0t_64_sync_handler+0xa0/0xe8 [ 441.858214] el0t_64_sync+0x1ac/0x1b0 [ 441.861865] Code: aa1303e0 97ff70a8 34ffff80 d10a4273 (f9445a75) [ 441.867946] ---[ end trace 0000000000000000 ]---

Therefore ---truncated---

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43413 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/362168 REF https://git.kernel.org/stable/c/21a13db8d449b9c7eda4471da7f12417602dbbc7 REF https://git.kernel.org/stable/c/40119a21d9769bf8fdab5c93c6c878296e628abf REF https://git.kernel.org/stable/c/70c78429ef383e35f9c58848994aeeac8083ae35 REF https://git.kernel.org/stable/c/8ddc0c26916574395447ebf4cff684314f6873a9 REF https://git.kernel.org/stable/c/a0e952a99440258a6130ec4119ea4c62a8b4716b REF https://git.kernel.org/stable/c/beadac156610a4f3bb15cb7bb4b07b6ac06f6567

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy