CVE-2025-37828

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: mcq: Add NULL check in ufshcdmcqabort()

A race can occur between the MCQ completion path and the abort handler: once a request completes, _blkmqfreerequest() sets rq->mqhctx to NULL, meaning the subsequent ufshcdmcqreqtohwq() call in ufshcdmcq_abort() can return a NULL pointer. If this NULL pointer is dereferenced, the kernel will crash.

Add a NULL check for the returned hwq pointer. If hwq is NULL, log an error and return FAILED, preventing a potential NULL-pointer dereference. As suggested by Bart, the ufshcdcmdinflight() check is removed.

This is similar to the fix in commit 74736103fb41 ("scsi: ufs: core: Fix ufshcdabortone racing issue").

This is found by our static analysis tool KNighter.