CVE-2026-90324: ublk: check import_ubuf() return value
In the Linux kernel, the following vulnerability has been resolved:
ublk: check importubuf() return value
importubuf() can fail if the address range (provided by the userspace ublk server) is outside the allowed user address space. Return that 0 bytes were copied if importubuf() fails rather than passing an uninitialized struct ioviter to ublkcopyuserpages().
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel ublk functionality are exposed when a userspace ublk server provides an address range that is outside the allowed user address space.
What condition is required to trigger the flaw?
The userspace ublk server must cause import_ubuf() to fail by supplying an invalid address range. The vulnerable path then passes an uninitialized struct iov_iter to ublk_copy_user_pages().
What does the fix change?
The fix checks the return value from import_ubuf(). If it fails, the operation reports that zero bytes were copied instead of using an uninitialized iterator.