CVE-2026-90324ublk: check import_ubuf() return value
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ublk: check import_ubuf() return value import_ubuf() can fail if the address range (provided by the userspace ublk server) is outside the allowed user address space. Return that 0 bytes were copied if import_ubuf() fails rather than passing an uninitialized struct iov_iter to ublk_copy_user_pages().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 981f95a571e3ca20a496c0b77dbf6b06039c6648 builds before 0121c84adb6a4cd6f7560b5895bd88f9899bbc1f; 981f95a571e3ca20a496c0b77dbf6b06039c6648 builds before 5ac6019cb78e98c9608fda72726b36ddf8474dd7; from 981f95a571e3ca20a496c0b77dbf6b06039c6648 before 3831568792af75b6523fa93bb91560e29189cf55 | CNA record |
References
- https://git.kernel.org/stable/c/0121c84adb6a4cd6f7560b5895bd88f9899bbc1f
- https://git.kernel.org/stable/c/5ac6019cb78e98c9608fda72726b36ddf8474dd7
- https://git.kernel.org/stable/c/3831568792af75b6523fa93bb91560e29189cf55
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.