6 matches found
SUSE CVE-2026-90323
In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...
Linux Distros Unpatched Vulnerability : CVE-2026-90323
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is...
CVE-2026-90323 ublk: validate auto buf reg before taking uring_cmd
In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...
CVE-2026-90323: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...
kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time
A flaw was found in the Linux kernel. A local user could exploit this flaw to cause data corruption by reusing a submission queue entry SQE before the corresponding command completes. This issue occurs because the iouring command handler accesses data from the original entry after the preparation...
CVE-2025-22068: Use After Free
In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq-canceling is set when queue is frozen Now ublk driver depends on ubq-canceling for deciding if the request can be dispatched via uringcmd & iouringcmdcompleteintask. Once ubq-canceling is set, the uringcmd can...