CVE-2026-45962: ublk: Validate SQE128 flag before accessing the cmd
In the Linux kernel, the following vulnerability has been resolved:
ublk: Validate SQE128 flag before accessing the cmd
ublkctrlcmddump() accesses (header )sqe->cmd before IOURINGFSQE128 flag check. This could cause out of boundary memory access.
Move the SQE128 flag check earlier in ublkctrluringcmd() to return -EINVAL immediately if the flag is not set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify ublk_ctrl_uring_cmd()/ublk_ctrl_cmd_dump() to move the SQE128 (IO_URING_F_SQE128) flag check earlier so that the function returns -EINVAL immediately when the flag is not set, preventing access to sqe->cmd and out-of-bounds memory access.
Linux kernel (ublk) IO_URING_F_SQE128 validation = validate before accessing sqe->cmd; return -EINVAL if not set
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exposure requires local access and low-privilege access to the affected system, according to the CVSS vector. No user interaction is required.
What condition triggers the issue?
The vulnerable path is reached when ublk control command handling accesses the command data before verifying that the IO_URING_F_SQE128 flag is set. Requests without that flag can trigger an out-of-bounds memory access.
What does the fix change?
The fix moves the IO_URING_F_SQE128 validation earlier in ublk_ctrl_uring_cmd(), causing requests without the flag to fail immediately with -EINVAL before command data is accessed.