Description
In the Linux kernel, the following vulnerability has been resolved:

ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

ublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into
ub->dev_info and then fixes up the fields the driver owns, but misses
->state and ->ublksrv_pid.

A device added with ->state = UBLK_S_DEV_LIVE passes the
"->state != UBLK_S_DEV_DEAD" test that ublk_stop_dev_unlocked() uses as its
proxy for "a disk is attached", while ->ub_disk is still NULL, so DEL_DEV
right after ADD_DEV oopses in del_gendisk(). UBLK_S_DEV_QUIESCED plus
UBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev(). A
poisoned ->state also gets START_USER_RECOVERY and the char device
read/write path onto a device that was never started, and wedges START_DEV
at -EEXIST. A poisoned ->ublksrv_pid just makes GET_DEV_INFO report an
unrelated task as the ublk server.

Reset both after the memcpy(), as ublk_detach_disk() does. Userspace only
ever reads these back, so correcting them silently breaks nothing.

ADD_DEV has copied ->state in unsanitized since ublk was merged, but back
then it was harmless: the gendisk was allocated during ADD_DEV, and both
teardown and the START_DEV -EEXIST check keyed off disk_live() rather than
->state. The oops became reachable once the disk allocation moved to
START_DEV and those checks switched to ->state.
Published: 2026-08-15
Score: 7.0 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel, a flaw in ublk_ctrl_add_dev() caused kernel‑owned fields (state and ublksrv_pid) to be left unreset after userspace data was copied. The stale state caused the kernel to treat a device as live, leading to an oops in del_gendisk, an oops in ublk_force_abort_dev, and a wedge in START_DEV. The result is a kernel crash that can deny system service. This bug cannot be corrected by userspace alone; the kernel must reset the fields as it does in ublk_detach_disk.

Affected Systems

The only affected product is the Linux kernel as provided by Linux:Linux. No specific kernel version is listed in the data, so all currently running kernels that include the legacy ublk_ctrl_add_dev() implementation are potentially vulnerable.

Risk and Exploitability

The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 7.0 classifies this issue as high severity. The likely attack vector remains local privileged or untrusted userspace programs that can add a ublk device; by manipulating the state and ublksrv_pid fields, an attacker can trigger kernel oopses. The resultant kernel crash would lead to a system reboot or unavailability, constituting a severe denial of service.

Generated by OpenCVE AI on August 21, 2026 at 21:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that resets the state and ublksrv_pid fields after the memcpy in ublk_ctrl_add_dev().
  • If an immediate kernel upgrade cannot be performed, disable or unmount ublk devices to prevent malicious addition of devices.
  • Monitor system logs for kernel oops occurrences and investigate any unknown ublk operations.

Generated by OpenCVE AI on August 21, 2026 at 21:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6466-1 linux security update
History

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-824
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Wed, 19 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
References

Sat, 15 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-416

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() ublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into ub->dev_info and then fixes up the fields the driver owns, but misses ->state and ->ublksrv_pid. A device added with ->state = UBLK_S_DEV_LIVE passes the "->state != UBLK_S_DEV_DEAD" test that ublk_stop_dev_unlocked() uses as its proxy for "a disk is attached", while ->ub_disk is still NULL, so DEL_DEV right after ADD_DEV oopses in del_gendisk(). UBLK_S_DEV_QUIESCED plus UBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev(). A poisoned ->state also gets START_USER_RECOVERY and the char device read/write path onto a device that was never started, and wedges START_DEV at -EEXIST. A poisoned ->ublksrv_pid just makes GET_DEV_INFO report an unrelated task as the ublk server. Reset both after the memcpy(), as ublk_detach_disk() does. Userspace only ever reads these back, so correcting them silently breaks nothing. ADD_DEV has copied ->state in unsanitized since ublk was merged, but back then it was harmless: the gendisk was allocated during ADD_DEV, and both teardown and the START_DEV -EEXIST check keyed off disk_live() rather than ->state. The oops became reachable once the disk allocation moved to START_DEV and those checks switched to ->state.
Title ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-19T16:37:23.182Z

Reserved: 2026-08-15T05:44:03.902Z

Link: CVE-2026-74472

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:51.953

Modified: 2026-08-19T17:21:04.490

Link: CVE-2026-74472

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74472 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:30:17Z

Weaknesses