CVE-2026-45975

A flaw was found in the Linux kernel's ublk subsystem. A local attacker could exploit a race condition where the kernel reads struct ublksrv_ctrl_cmd from userspace-mapped memory without proper synchronization. This allows a malicious user to concurrently write to the structure, potentially causing the kernel to operate on inconsistent data and leading to unpredictable system behavior.

A moderate-severity race condition was found in the Linux kernel's ublk (userspace block device) subsystem. The ublk control command structure (struct ublksrv_ctrl_cmd) is embedded in the io_uring submission queue entry, which may reside in userspace-mapped memory. The kernel previously read this structure with normal, unsynchronized loads, so a local attacker with low privileges could concurrently modify the command fields while the kernel was processing them. This could cause the kernel to validate one set of values but operate on another, resulting in inconsistent control-command handling and unpredictable system behavior, including possible denial of service.

Red Hat Enterprise Linux 10.3 is affected by this flaw, and a fix is being pursued for that stream. All other Red Hat Enterprise Linux kernel and kernel-rt streams (RHEL 6, 7, 8, 9, and 10.0.z/10.2.z) and Red Hat In-Vehicle OS 2.0 are not affected because the vulnerable code, introduced by a recent ublk change enabling non-blocking control commands, is not present in those versions.

NIST rates this flaw as CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate) considering availability impact only, while the Red Hat CVSS score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) additionally accounts for potential confidentiality and integrity consequences of the kernel acting on attacker-controlled, inconsistent control-command data. The overall Red Hat impact for this flaw is moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.