Bug 2481935 (CVE-2026-45975)

Summary: CVE-2026-45975 kernel: ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `ublk` subsystem. A local attacker could exploit a race condition where the kernel reads `struct ublksrv_ctrl_cmd` from userspace-mapped memory without proper synchronization. This allows a malicious user to concurrently write to the structure, potentially causing the kernel to operate on inconsistent data and leading to unpredictable system behavior.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-27 15:03:09 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd

struct ublksrv_ctrl_cmd is part of the io_uring_sqe, which may lie in
userspace-mapped memory. It's racy to access its fields with normal
loads, as userspace may write to them concurrently. Use READ_ONCE() to
copy the ublksrv_ctrl_cmd from the io_uring_sqe to the stack. Use the
local copy in place of the one in the io_uring_sqe.
Comment 1 Keith Grant 2026-05-27 22:32:47 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052737-CVE-2026-45975-e0a6@gregkh/T