Cloudanix VulnDB

CVE-2026-90323

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain block devices can cause the system to freeze when shutting down those devices if bad input is provided.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper input validation in the ublk driver allows an invalid sqe->addr to cause uring_cmd completion after UBLK_IO_FLAG_ACTIVE is set, leaving the I/O tag active and hanging device teardown.

Why it matters to the business

Systems relying on ublk devices may experience hangs during shutdown or device removal, leading to prolonged downtime and requiring manual intervention or reboot.

How an attack unfolds

An attacker with local access submits a uring command using UBLK_F_AUTO_BUF_REG with an invalid address; the driver sets the active flag before validation fails, completes the command, and leaves the tag active so subsequent teardown hangs.

How to fix it

Apply the upstream kernel patch that separates validation from buffer application and ensures uring_cmd is taken only after validation succeeds; rebuild and deploy the fixed kernel.

How to confirm the fix worked

Confirm the patched kernel contains the reordered validation logic before ublk_fill_io_cmd and before storing the buffer in both submission and FETCH paths; test device creation, I/O, and teardown under invalid address conditions.

Typical attack path

  1. Obtain local access to a system with ublk enabled
  2. Register a ublk device with UBLK_F_AUTO_BUF_REG
  3. Submit uring command containing invalid sqe->addr
  4. Trigger device teardown to observe hang

How to detect it

Review kernel logs for ublk teardown stalls or hung tasks involving uring_cmd and UBLK_IO_FLAG_ACTIVE; examine io_uring submission traces for malformed addr values around device removal events.

What your security team should do

  • Prioritize kernel update on any hosts exposing ublk devices
  • Monitor for ublk-related hangs during maintenance windows
  • Restrict unprivileged use of io_uring and ublk until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uring_cmd With UBLK_F_AUTO_BUF_REG, invalid sqe->addr can fail after ublk_fill_io_cmd() has set UBLK_IO_FLAG_ACTIVE. The uring_cmd is completed while the tag stays active, which can hang teardown. Split validation from buffer apply so the check has no side effects, then take the uring_cmd and store the already-validated buffer. Apply the same order in FETCH so io->buf is not written before __ublk_fetch() state checks.

Affected packages

Ecosystem Package Introduced Fixed