Executive brief
A vulnerability in the Linux kernel's ublk driver can cause a system deadlock when certain processes, such as device managers, attempt to read partition tables from a ublk block device. This issue occurs because the system can get stuck in a loop waiting for a resource it already holds, effectively freezing the affected storage operations. This can lead to a local denial-of-service, impacting system stability and the availability of storage services.
Technical details
A deadlock exists in the Linux kernel ublk driver (ublk_drv.c) due to improper locking during partition table reads. When a process opens a ublk device via bdev_open(), it acquires the disk->open_mutex. If the subsequent I/O completion triggers an fput() on the device's file descriptor, the cleanup work (blkdev_release) may be deferred to the current task's context. This results in the same task attempting to re-acquire the already-held disk->open_mutex, causing a deadlock. The vulnerability is categorized as CWE-667 (Improper Locking). The fix involves disabling bottom halves during request completion (blk_update_request and blk_mq_end_request), which forces the release logic to run in a separate kernel work-queue context.
Affected products
- Linux Linux Kernel 6.0 to 6.6.124, 6.7 to 6.12.70, 6.13 to 6.18.3, 6.19-rc1
Timeline
- 2025-12-12: other: Initial patch authored
- 2026-01-13: advisory: CVE published
- 2026-01-02: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/0460e09a614291f06c008443f47393c37b7358e7
- https://git.kernel.org/stable/c/27bb79b7717b2fbb111a1c13548b2786ee712dca
- https://git.kernel.org/stable/c/64c0b7e2293757e8320f13434cd809f1c9257a62
- https://git.kernel.org/stable/c/9bcc47343ee0ef346aa7b2b460c8ff56bd882fe7
- https://git.kernel.org/stable/c/c258f5c4502c9667bccf5d76fa731ab9c96687c1