CVE-2026-90323: ublk: validate auto buf reg before taking uring_cmd
In the Linux kernel, the following vulnerability has been resolved:
ublk: validate auto buf reg before taking uringcmd
With UBLKFAUTOBUFREG, invalid sqe->addr can fail after ublkfilliocmd() has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown.
Split validation from buffer apply so the check has no side effects, then take the uringcmd and store the already-validated buffer. Apply the same order in FETCH so io->buf is not written before ublkfetch() state checks.
Event History
Frequently Asked Questions
What condition is required to trigger the teardown hang?
UBLK must be using UBLK_F_AUTO_BUF_REG, and an invalid sqe->addr must be supplied. The failure can occur after the I/O tag has been marked active, while the uring_cmd is completed.
What is the operational impact of the flawed state handling?
The tag can remain active after the uring_cmd completes, which can cause ublk teardown to hang. The FETCH path also needed ordering changes to avoid writing io->buf before its state checks.
What change addresses the issue?
The fix validates the buffer before taking the uring_cmd and stores only the already-validated buffer afterward. It similarly performs FETCH state checks before writing io->buf.