Technical impact
The vulnerability lies in the Linux kernel’s ublk subsystem where the struct ublksrv_ctrl_cmd, embedded in a userspace‑mapped io_uring submission queue entry, is accessed with normal loads. Because the kernel may read this structure concurrently while userspace writes to it, the loaded values can become torn or stale, causing the kernel to process an incorrect command. This race condition could disrupt device command handling and result in unpredicted kernel behavior. The underlying weakness is a race condition that violates atomic access to shared data. The flaw corresponds to CWE-820, NVD-CWE-noinfo.
Affected Systems
All Linux kernel releases that expose the ublk driver and allow userspace applications to submit io_uring entries containing ublksrv_ctrl_cmd structures are potentially affected. No explicit version constraints were provided, so the impact spectrum extends to any kernel build implementing the unpatched ublk logic.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% indicates an extremely low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. Attackers would need to invoke the race by manipulating userspace memory mapped to the kernel, which implies the attack is local and dependent on the ability to write to the mapped region. Given the low EPSS probability, the overall risk remains moderate, but a successful race could destabilize the kernel and disrupt services.
