CVE-2026-43364: ublk: fix NULL pointer dereference in ublk_ctrl_set_size()
In the Linux kernel, the following vulnerability has been resolved:
ublk: fix NULL pointer dereference in ublkctrlsetsize()
ublkctrlsetsize() unconditionally dereferences ub->ubdisk via setcapacityandnotify() without checking if it is NULL.
ub->ubdisk is NULL before UBLKCMDSTARTDEV completes (it is only assigned in ublkctrlstartdev()) and after UBLKCMDSTOPDEV runs (ublkdetachdisk() sets it to NULL). Since the UBLKCMDUPDATESIZE handler performs no state validation, a user can trigger a NULL pointer dereference by sending UPDATESIZE to a device that has been added but not yet started, or one that has been stopped.
Fix this by checking ub->ubdisk under ub->mutex before dereferencing it, and returning -ENODEV if the disk is not available.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43364?
CVE-2026-43364 has been classified with a high severity due to its potential to cause a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2026-43364?
To fix CVE-2026-43364, apply the latest patches available from your Linux distribution that address this vulnerability.
Which versions of Linux are affected by CVE-2026-43364?
CVE-2026-43364 affects multiple versions of the Linux kernel prior to the patch being applied.
What happens if CVE-2026-43364 is exploited?
Exploitation of CVE-2026-43364 can lead to system crashes or unpredictable behavior due to a NULL pointer dereference.
Is CVE-2026-43364 related to other vulnerabilities?
CVE-2026-43364 is specifically related to the ublk subsystem in the Linux kernel, and while it may have similarities to other vulnerabilities, it stands alone in its specifics.