CVE-2026-74472

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ublk ctrl add dev() function where the kernel fails to reset specific kernel-owned fields after copying ublsrv ctrl dev info from userspace into ub->dev info. Specifically, the state and ublksrv pid variables are not sanitized. If a device is added with a manipulated state value, such as UBLK S DEV LIVE, it can bypass internal checks in ublk stop dev unlocked(), leading to a system crash (oops) in del gendisk() because ub disk remains NULL. Additionally, a poisoned state can allow unauthorized access to the character device read/write path or cause START DEV to fail with -EEXIST. A manipulated ublksrv pid can cause GET DEV INFO to report an incorrect task as the ublk server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.