In the Linux kernel, the following vulnerability has been resolved:
ublk: validate auto buf reg before taking uring_cmd
With UBLK_F_AUTO_BUF_REG, invalid sqe->addr can fail after
ublk_fill_io_cmd() has set UBLK_IO_FLAG_ACTIVE. The uring_cmd is
completed while the tag stays active, which can hang teardown.
Split validation from buffer apply so the check has no side effects,
then take the uring_cmd and store the already-validated buffer. Apply
the same order in FETCH so io->buf is not written before __ublk_fetch()
state checks.
CVSS
No CVSS.
References
Configurations
No configuration.
History
17 Sep 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-17 17:17
Updated : 2026-09-17 17:17
NVD link : CVE-2026-90323
Mitre link : CVE-2026-90323
CVE.ORG link : CVE-2026-90323
JSON object : View
Products Affected
No product.
CWE
No CWE.