HIGH Introduced in 6.5
ublk IovIter Uninit
CVE-2026-90324
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ublk: check import_ubuf() return value import_ubuf() can fail if the address range (provided by the userspace ublk server) is outside the allowed user address space. Return that 0 bytes were copied if import_ubuf() fails rather than passing an uninitialized struct iov_iter to ublk_copy_user_pages().
02KernelScan AI Analysis
Risk summary
A local attacker with root or CAP_SYS_ADMIN who is running a ublk server can supply an out-of-range user address, causing an uninitialized iov_iter to be passed to the kernel's page-copy routine. This can result in arbitrary kernel memory reads, writes, or a crash. The risk is limited to systems where the ublk driver is loaded and a ublk device is configured.
Vulnerability analysis
When a userspace ublk server supplies a memory address range that is outside the allowed user address space, the kernel's routine for importing that range into an internal iterator fails — but the driver ignored the failure and passed the now-uninitialized iterator to the page-copy routine. That routine then operates on garbage data, potentially reading from or writing to arbitrary kernel memory or crashing the kernel. The fix checks the import routine's return value and, on failure, reports that zero bytes were copied instead of proceeding with the uninitialized iterator. This vulnerability is reachable only from a local process that has already set up a ublk device, which requires root or CAP_SYS_ADMIN in the init namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.5 | 7.2.6 | 5ac6019cb78e |
| 6.18 | 6.5 | 6.18.52 | 0121c84adb6a |
| mainline | 6.5 | 7.3-rc1 | 3831568792af |