Executive brief
Linux kernel's ublk (user-space block device) driver failed to validate return values from the import_ubuf() function, which can reject invalid memory addresses from userspace. An attacker could supply a malicious address range that causes the kernel to pass uninitialized data structures to other functions, potentially leading to information disclosure or denial of service.
Technical details
The vulnerability is an unchecked return value bug in the ublk block device driver (drivers/block/ublk_drv.c). The import_ubuf() function validates whether a user-supplied address range lies within allowed user address space and returns a negative error code if validation fails. The ublk_map_io() and ublk_unmap_io() functions called import_ubuf() but did not check its return value before passing the potentially uninitialized iov_iter struct to ublk_copy_user_pages(). A local or network-adjacent attacker controlling the userspace ublk server could provide an out-of-bounds address, causing the driver to use uninitialized kernel memory. The patch adds return value checks on both import_ubuf() calls to return early if validation fails. Patches are available in upstream Linux kernel and stable branches.
Affected products
- Linux Linux kernel multiple versions up to and including 6.x (patched in stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90324 published
- 2026-08-03: patched: Upstream fix committed by Jens Axboe
- 2026-09-14: patched: Stable kernel backport by Greg Kroah-Hartman