CVE-2026-22995: ublk: fix use-after-free in ublk_partition_scan_work
In the Linux kernel, the following vulnerability has been resolved:
ublk: fix use-after-free in ublkpartitionscanwork
A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ubdisk:
1. ublkctrlstartdev() schedules partitionscanwork after adddisk() 2. ublkstopdev() calls ublkstopdevunlocked() which does: - delgendisk(ub->ubdisk) - ublkdetachdisk() sets ub->ubdisk = NULL - putdisk() which may free the disk 3. The worker ublkpartitionscanwork() then dereferences ub->ubdisk leading to UAF
Fix this by using ublkgetdisk()/ublkputdisk() in the worker to hold a reference to the disk during the partition scan. The spinlock in ublkgetdisk() synchronizes with ublkdetachdisk() ensuring the worker either gets a valid reference or sees NULL and exits early.
Also change flushwork() to cancelworksync() to avoid running the partition scan work unnecessarily when the disk is already detached.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22995?
CVE-2026-22995 is classified as a medium severity vulnerability due to its potential for causing crashes or other unpredictable behavior.
How do I fix CVE-2026-22995?
To fix CVE-2026-22995, apply the latest Linux kernel updates that address the use-after-free vulnerability in ublk_partition_scan_work.
What systems are affected by CVE-2026-22995?
CVE-2026-22995 affects various versions of the Linux kernel that utilize the ublk subsystem.
What type of vulnerability is CVE-2026-22995?
CVE-2026-22995 is classified as a use-after-free vulnerability caused by a race condition.
What are the potential impacts of CVE-2026-22995?
The impacts of CVE-2026-22995 may include system crashes, data corruption, or execution of arbitrary code due to the use-after-free condition.