CVE-2026-90324

What it actually does

Failure to check import_ubuf() return value allows an uninitialized struct iov_iter to be passed to ublk_copy_user_pages(), resulting in use of invalid memory ranges supplied from userspace.

Why it matters to the business

Local attackers can trigger kernel memory corruption on affected Linux systems, leading to crashes, data corruption, or privilege escalation that disrupts operations and requires emergency patching.

How an attack unfolds

An attacker running as a local user supplies a userspace address range outside the allowed address space to the ublk driver, causing import_ubuf() to fail; the uninitialized iov_iter is then used in copy operations, enabling memory corruption or information disclosure.

How to fix it

Apply the upstream kernel patch that returns zero bytes copied on import_ubuf() failure; rebuild and deploy updated kernels to all affected systems; prioritize systems with ublk enabled.

How to confirm the fix worked

Confirm the fix by inspecting the ublk driver source for the import_ubuf() return-value check before calling ublk_copy_user_pages(); verify updated kernel versions contain the commit; test with crafted userspace addresses that previously triggered the flaw.

Typical attack path

1. Obtain local user access on a system using the ublk driver
2. Map or craft an address range that import_ubuf() rejects
3. Invoke ublk operations that call import_ubuf() without checking its return value
4. Trigger ublk_copy_user_pages() with the resulting uninitialized iov_iter
5. Achieve memory corruption, crash, or escalation

How to detect it

Review kernel logs for ublk-related oops or warnings involving iov_iter or copy_user_pages; correlate with process activity invoking ublk ioctls from untrusted users; inspect for unexpected kernel panics on systems running ublk servers.

What your security team should do

• Immediately audit all Linux kernels for ublk driver usage
• Schedule kernel updates containing the import_ubuf() check within the next maintenance window
• Disable ublk where not required until patches are applied
• Monitor for local privilege-escalation attempts targeting block-device drivers