CVE-2026-53124: ublk: reset per-IO canceled flag on each fetch
In the Linux kernel, the following vulnerability has been resolved:
ublk: reset per-IO canceled flag on each fetch
If a ublk server starts recovering devices but dies before issuing fetch commands for all IOs, cancellation of the fetch commands that were successfully issued may never complete. This is because the per-IO canceled flag can remain set even after the fetch for that IO has been submitted - the per-IO canceled flags for all IOs in a queue are reset together only once all IOs for that queue have been fetched. So if a nonempty proper subset of the IOs for a queue are fetched when the ublk server dies, the IOs in that subset will never successfully be canceled, as their canceled flags remain set, and this prevents ublkcancelcmd from actually calling iouringcmddone on the commands, despite the fact that they are outstanding.
Fix this by resetting the per-IO cancel flags immediately when each IO is fetched instead of waiting for all IOs for the queue (which may never happen).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the fix described: reset the per-IO canceled flags immediately when each IO is fetched, rather than waiting for all IOs for the queue. This prevents ublk_cancel_cmd from being blocked when the server dies before fetch completion.
Linux kernel (ublk) per-IO canceled flags reset behavior = Reset per-IO canceled flags immediately when each IO is fetched
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53124?
CVE-2026-53124 has a risk score of 27, indicating a significant vulnerability in the Linux kernel.
How do I fix CVE-2026-53124?
To fix CVE-2026-53124, ensure that your Linux kernel is updated to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-53124?
CVE-2026-53124 specifically affects the Linux kernel implementations that utilize the ublk server functionality.
What are the consequences of CVE-2026-53124?
The consequences of CVE-2026-53124 include potential data loss and uncompleted fetch command cancellations on affected server systems.
Is there a workaround for CVE-2026-53124?
Currently, the best recommendation for CVE-2026-53124 is to apply the kernel update as there are no known effective workarounds.