In the Linux kernel's ublk subsystem, the function ublk_ctrl_set_size() performs an unconditional dereference of the ub->ub_disk pointer without verifying that the disk object is initialized. Because ub->ub_disk is NULL until the UBLK_CMD_START_DEV command finishes and is reset to NULL after a UBLK_CMD_STOP_DEV operation, an attacker can issue a UBLK_CMD_UPDATE_SIZE command to a device that is either not yet started or has already been stopped. This causes a NULL pointer dereference within the kernel, which typically results in a kernel crash or catastrophic failure. The impact is a denial of service that could terminate the kernel and disrupt all processes on the affected system.

The vulnerability resides in the generic Linux kernel and affects all releases that include the ublk driver before the patch committed in revision 25966fc097691e5c925ad080f64a2f19c5fd940a. The issue is not tied to a particular vendor distribution, as it applies to all distributions shipping the upstream kernel for which this commit is not present. Users of the ublk device interface should verify whether their kernel version includes the fix; if it does not, the vulnerability is present.

The CVSS score of 5.5 indicates a moderate severity, reflecting the potential for a kernel crash that disrupts availability. EPSS data is not available. Because the attack requires local control over the ublk control interface, privilege escalation to root is not strictly required; any user with access to the ublk device can trigger the exploit. The vulnerability is not listed in the CISA KEV catalog, and no active exploits are reported, so the likelihood of exploitation in the wild remains uncertain but the potential impact is high if the flaw is leveraged.