Executive brief
A vulnerability was identified in the Linux kernel's ublk driver, which is used for creating block devices in userspace. The issue could allow an attacker to trigger an out-of-bounds memory access, potentially leading to a system crash or instability. This affects the reliability of systems utilizing userspace block storage drivers.
Technical details
An out-of-bounds memory access vulnerability exists in the Linux kernel's ublk driver (drivers/block/ublk_drv.c). The function ublk_ctrl_cmd_dump() incorrectly accesses the sqe->cmd header before verifying the IO_URING_F_SQE128 flag. If a specially crafted io_uring command is submitted without this flag, the kernel may attempt to read memory outside the intended buffer. This is a local vulnerability that requires the ability to interact with the ublk control interface. The fix involves moving the flag validation earlier in ublk_ctrl_uring_cmd() to ensure the command is valid before it is processed or dumped. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel ublk driver component
Timeline
- 2026-01-30: other: Patch authored
- 2026-05-27: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/17d33ba7291100008360b5a354962db37ad80684
- https://git.kernel.org/stable/c/31cac6acf77ece488f29fb8f79589d9298e969c8
- https://git.kernel.org/stable/c/4b4dff498f46e9802f71bc84258bf73065f51c6a
- https://git.kernel.org/stable/c/da7e4b75e50c087d2031a92f6646eb90f7045a67
- https://git.kernel.org/stable/c/dbe8e81a2ec608f87f79a34f6444cd62f6a243bb
- https://git.kernel.org/stable/c/f75a5555e0049e7857eae25b60aee98b80e287ec