CVE-2026-45975
Description
A flaw was found in the Linux kernel's ublk subsystem. A local attacker could exploit a race condition where the kernel reads struct ublksrv_ctrl_cmd from userspace-mapped memory without proper synchronization. This allows a malicious user to concurrently write to the structure, potentially causing the kernel to operate on inconsistent data and leading to unpredictable system behavior.
Statement
A moderate-severity race condition was found in the Linux kernel's ublk (userspace block device) subsystem. The ublk control command structure (struct ublksrv_ctrl_cmd) is embedded in the io_uring submission queue entry, which may reside in userspace-mapped memory. The kernel previously read this structure with normal, unsynchronized loads, so a local attacker with low privileges could concurrently modify the command fields while the kernel was processing them. This could cause the kernel to validate one set of values but operate on another, resulting in inconsistent control-command handling and unpredictable system behavior, including possible denial of service.
Red Hat Enterprise Linux 10.3 is affected by this flaw, and a fix is being pursued for that stream. All other Red Hat Enterprise Linux kernel and kernel-rt streams (RHEL 6, 7, 8, 9, and 10.0.z/10.2.z) and Red Hat In-Vehicle OS 2.0 are not affected because the vulnerable code, introduced by a recent ublk change enabling non-blocking control commands, is not present in those versions.
NIST rates this flaw as CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate) considering availability impact only, while the Red Hat CVSS score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) additionally accounts for potential confidentiality and integrity consequences of the kernel acting on attacker-controlled, inconsistent control-command data. The overall Red Hat impact for this flaw is moderate.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.3 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | None | N/A |
| Integrity Impact | Low | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
