CVE-2026-68173

A flaw was found in the ublk component of the Linux kernel. This vulnerability occurs when the ublk server sends an END_USER_RECOVERY command without a successful START_USER_RECOVERY. This can cause I/O requests to become stranded, leading to subsequent file system synchronization operations (fsync) to pile up in an uninterruptible sleep state. The most significant consequence is a system hang, effectively resulting in a Denial of Service (DoS).

This vulnerability is classified as having a Moderate impact because exploitation requires local access to interact with the userspace block device interface and only results in a denial of service without compromising data integrity or confidentiality. Older enterprise releases, including Red Hat Enterprise Linux 8 and 9, do not include the vulnerable code path and remain unaffected. In environments utilizing ublk, the issue only manifests if an unhandled error occurs during device recovery cycles, causing input/output operations to stall and hang waiting processes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.