Executive brief
A race condition vulnerability was identified in the Linux kernel's ublk (Userspace Block Device) driver. This component allows block devices to be implemented in userspace. An attacker could potentially exploit this flaw to cause unpredictable system behavior or bypass security checks by modifying command data while the kernel is in the process of reading it.
Technical details
The vulnerability exists in the ublk driver (drivers/block/ublk_drv.c) due to unsafe access to 'struct ublksrv_ctrl_cmd' within 'io_uring_sqe'. Because this structure resides in memory mapped to userspace, it is subject to Time-of-Check Time-of-Use (TOCTOU) race conditions where a malicious userspace process can modify command fields (such as dev_id, addr, or len) after the kernel has performed initial validation but before it completes execution. The fix introduces the use of READ_ONCE() to atomically copy the command structure from userspace-mapped memory to the kernel stack, ensuring the kernel operates on a stable, local copy.
Affected products
- Linux Linux Kernel Fixed in commits ce63eda and ed9f54c
Timeline
- 2026-01-30: other: Patch authored
- 2026-05-27: disclosed: CVE published