CVE-2026-74472

A flaw was found in the Linux kernel's ublk driver. This vulnerability arises from improper initialization of kernel-owned device information fields when a new ublk device is added. A local attacker could exploit this by providing malformed device information, which may lead to a kernel panic, resulting in a Denial of Service (DoS) for the system. This issue can also cause system instability or incorrect reporting of the ublk server process.

ublk_ctrl_add_dev copied userspace supplied dev_info into the kernel object and did not reset driver owned fields such as state and ublksrv_pid. A local user with access to the ublk control interface could add a device with a poisoned state that makes it look live before ub_disk is allocated, then remove it and trigger a NULL pointer dereference in del_gendisk. For the CVSS the PR:L is used because reliable triggering requires a local process with access to the ublk control interface, but not necessarily full administrator privileges in deployments that delegate ublk usage. The issue is not network reachable and is triggered through local block device control operations. Impact is primarily denial of service via kernel crash. The paranoid score keeps availability high and integrity low because userspace controlled driver owned state can disturb the ublk device lifecycle, but there is no clear arbitrary write or UAF primitive in the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.