PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45962 Linux CVE debrief

A vulnerability in the Linux kernel's ublk (userspace block device) subsystem could allow out-of-bounds memory access. The issue exists in ublk_ctrl_cmd_dump(), which accesses sqe->cmd as a header pointer before verifying that the IO_URING_F_SQE128 flag is set. Without this flag check, the function may read beyond allocated memory boundaries. The fix moves the SQE128 flag validation earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not present, preventing unsafe memory access.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with ublk enabled; security teams tracking kernel memory safety issues; organizations using io_uring-based block device virtualization

Technical summary

The ublk kernel driver for userspace block devices contains a validation ordering flaw. When processing control commands via io_uring, ublk_ctrl_cmd_dump() dereferences sqe->cmd as a header structure before confirming the command uses the extended SQE128 format. This premature access can read past the end of a standard 64-byte SQE, resulting in out-of-bounds kernel memory access. The resolution restructures ublk_ctrl_uring_cmd() to validate IO_URING_F_SQE128 before any command data access, failing with -EINVAL for non-compliant submissions.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and confirm if ublk driver is in use
  • Apply kernel updates from distribution vendor when available
  • Monitor stable kernel branches for applicable backported fixes
  • Consider disabling ublk if not required until patch is applied

Evidence notes

The vulnerability description indicates this is a memory safety issue in kernel code handling io_uring commands for ublk. The fix involves reordering validation logic to check the SQE128 flag before accessing command data. Multiple stable kernel branch commits are referenced, suggesting backports to supported kernel versions.

Official resources

2026-05-27