Executive brief
A vulnerability in the Linux kernel's ublk driver could allow a local user to crash the system. The ublk component is used to manage user-space block devices, which are virtual disks handled by applications rather than the kernel itself. By sending a specific command to a device that is not yet fully started or has already been stopped, an attacker can trigger a system failure (kernel panic), leading to a denial of service.
Technical details
A NULL pointer dereference exists in the ublk_ctrl_set_size() function within drivers/block/ublk_drv.c. The function unconditionally dereferences the 'ub_disk' pointer via set_capacity_and_notify() without verifying its state. Because 'ub_disk' is only assigned during device start and is cleared during device stop, a local attacker can trigger the crash by issuing a UBLK_CMD_UPDATE_SIZE command via io_uring_cmd when the device is in an invalid state. The fix introduces a NULL check under the device mutex and returns -ENODEV if the disk is unavailable.
Affected products
- Linux Linux Kernel Versions including ublk driver with UBLK_U_CMD_UPDATE_SIZE support
Timeline
- 2026-03-05: patched: Initial patch authored by Mehul Rao
- 2026-05-08: disclosed: CVE published