CVE-2026-90324

A flaw was found in the ublk component of the Linux kernel. A local attacker, by providing an invalid address range from a userspace ublk server, could cause the import_ubuf() function to fail. This failure, if not properly handled, leads to an uninitialized data structure being used in subsequent operations, potentially resulting in a system crash and a denial of service.

A moderate-severity flaw was found in the Linux kernel's ublk (userspace block device) subsystem. The import_ubuf() function can fail when a userspace ublk server provides an address range that lies outside the allowed user address space. Because the return value of import_ubuf() was not checked, an uninitialized struct iov_iter could be passed to ublk_copy_user_pages(), potentially resulting in a system crash and denial of service. This flaw requires local access with the privileges needed to operate a ublk server, and its impact is limited to availability. Red Hat therefore rates it Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs from the CVE.org score of 7.8, which additionally assumes high confidentiality and integrity impacts that the available technical evidence does not support. Earlier Red Hat Enterprise Linux versions (RHEL 6 through RHEL 9, including kernel-rt) and OpenShift Container Platform versions are not affected because the vulnerable code is not present in their kernels. The kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 does contain the vulnerable code and is affected; the fix for these products has been deferred, so a corrective update will be delivered in a future release, and until then the residual risk is a local denial of service triggered through a privileged ublk server process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.