CVE-2026-22995

ublk: fix use-after-free in ublk_partition_scan_work

View on CVE.org
Published Jan 23, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:

ublk: fix use-after-free in ublk_partition_scan_work

A race condition exists between the async partition scan work and device
teardown that can lead to a use-after-free of ub->ub_disk:

1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()
2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:
- del_gendisk(ub->ub_disk)
- ublk_detach_disk() sets ub->ub_disk = NULL
- put_disk() which may free the disk
3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk
leading to UAF

Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold
a reference to the disk during the partition scan. The spinlock in
ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker
either gets a valid reference or sees NULL and exits early.

Also change flush_work() to cancel_work_sync() to avoid running the
partition scan work unnecessarily when the disk is already detached.

Analysis

AI-generated

Technical impact

The race condition between asynchronous partition‑scan work and device teardown in the Linux kernel’s ublk subsystem results in a use‑after‑free of the ub_disk pointer. This memory corruption flaw (CWE‑416) can cause a kernel fault, system crash, or, in a rare case, execution of arbitrary code with kernel privileges.

Affected Systems

The flaw exists in the Linux kernel’s ublk component. All kernel releases that include the race, notably 6.19‑rc4 and earlier, are affected. System‑level or kernel‑level updates that incorporate the patch resolve the issue.

Risk and Exploitability

The CVSS score is 7.8, indicating high severity, while the EPSS score is below 1 %, indicating a low current probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is inference: a local or privileged user could trigger a ublk device partition scan while simultaneously tearing down the device, which leads to the race and the subsequent use‑after‑free. This inference is based on the race description rather than explicit attack details.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel update that includes the ublk use‑after‑free fix.
  • If an immediate kernel upgrade is not possible, disable or remove the ublk subsystem (e.g., by setting CONFIG_BLK_DEV_UBLK to n) to eliminate the race condition.
  • For custom kernel modules or drivers that interact with ublk, review and modify them to use ublk_get_disk()/ublk_put_disk() patterns to avoid dangling references.

Generated by OpenCVE AI on April 18, 2026 at 15:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ub_disk: 1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk() 2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does: - del_gendisk(ub->ub_disk) - ublk_detach_disk() sets ub->ub_disk = NULL - put_disk() which may free the disk 3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk leading to UAF Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold a reference to the disk during the partition scan. The spinlock in ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker either gets a valid reference or sees NULL and exits early. Also change flush_work() to cancel_work_sync() to avoid running the partition scan work unnecessarily when the disk is already detached.
Title ublk: fix use-after-free in ublk_partition_scan_work
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Linux
Published
Updated
May 11, 2026, 9:57 PM
Reserved
Jan 13, 2026, 3:37 PM

View source JSON

No data.

Status
Analyzed
Published
Jan 23, 2026, 4:15 PM
Modified
Jun 17, 2026, 10:20 AM

View source JSON

Severity
Moderate
Public date
Jan 23, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Apr 18, 2026, 3:15 PM

JSON