CVE-2026-74472 Linux CVE debrief

Who should care

Linux kernel developers, administrators who use the Linux kernel, and security teams responsible for vulnerability management and patching should be aware of this vulnerability and take necessary actions to mitigate it. They should review the patch and verify device state and disk detachment in the Linux kernel. Additionally, they should monitor for potential issues with char device read/write paths and review compensating controls for exposed systems.

Technical summary

The Linux kernel vulnerability CVE-2026-74472 was caused by the ublk_ctrl_add_dev() function failing to reset kernel-owned dev_info fields. This allowed a device to be added with an incorrect state, causing issues with disk detachment and char device read/write paths. The vulnerability was resolved by resetting the kernel-owned dev_info fields in ublk_ctrl_add_dev(). Affected Linux kernel developers and administrators should review and apply the patch to prevent potential issues.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
• Verify device state and disk detachment in the Linux kernel
• Monitor for potential issues with char device read/write paths
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was introduced in the Linux kernel's ublk_ctrl_add_dev() function, which failed to reset kernel-owned dev_info fields. This caused issues with device state and disk detachment. The vulnerability was resolved by resetting the kernel-owned dev_info fields in ublk_ctrl_add_dev(). To verify, defenders should review the patch and check for potential issues with char device read/write paths. Additionally, they should monitor for device state and disk detachment issues in the Linux kernel.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.