In the Linux kernel the ublk user‑space block driver used an edge‑triggered latch, ub->completion, to indicate that a device’s FETCH stream had finished. The latch was only re‑armed after a successful START_USER_RECOVERY. When the daemon sent END_USER_RECOVERY after an earlier START that failed with -EBUSY and the error was ignored, the stale completion was satisfied, the device was incorrectly marked LIVE, and the requeue list was kicked while the FETCH stream was still running. This caused queued I/O requests to remain stranded, leading to a dead‑lock of the flush machinery and an uninterruptible sleep for subsequent fsync operations, effectively denying service to applications using the affected ublk device.

The vulnerability is present in all versions of the Linux kernel that include the ublk driver prior to the patching commit. The product is the Linux kernel; no specific affected release is enumerated in the advisory.

CVSS 7.1 indicates high severity, and the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker controlling the ublk server or daemon; for example, by inducing a crash or sending an END_USER_RECOVERY after a failed START. This can trigger a deadlock of the flush machinery, causing queued I/O requests to hang and leading to a denial‑of‑service condition and prolonged system unresponsiveness. The CVE data does not mention any public exploits, so it is unknown whether such exploits exist.