Vulnerability-Lookup

FKIE_CVE-2026-68173

Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-17 05:18

Severity

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublk_dev_ready() instead of ub->completion ub->completion is only re-armed by a successful START_USER_RECOVERY. If the ublk server sends END_USER_RECOVERY without one - e.g. its START failed with -EBUSY and the error was ignored - the wait is satisfied by the stale completion of the previous recovery cycle, and the device is marked LIVE and the requeue list kicked while the FETCH stream is still running and ubq->canceling is still set. The kick redispatches a previously requeued request, __ublk_queue_rq_common() sees ->canceling and parks it again via __ublk_abort_rq(), and after the last FETCH clears ->canceling nothing ever kicks the requeue list again: the request is stranded there while holding its tag. If it is the flush machinery's flush_rq, every subsequent fsync piles up in uninterruptible sleep and teardown hangs on tag draining. This matches a report of a lost PREFLUSH with ext4 on top of ublk after daemon crash recovery. ub->completion is an edge-triggered latch used as a proxy for the level condition "every queue has fetched all I/O commands", which can regress (F_BATCH's UNPREP, daemon death) and whose re-arm can be skipped. Drop it and wait on the real condition instead: the new helper ublk_wait_dev_ready_and_lock() waits on ublk_dev_ready() via wait_var_event_interruptible(), woken from ublk_mark_io_ready(), then re-checks it under ub->mutex, waiting again on regression, and returns with the mutex held and readiness guaranteed. Readiness becomes true in the same ub->mutex critical section that clears the last queue's ->canceling, so END_USER_RECOVERY marks the device LIVE and kicks the requeue list strictly after ->canceling clears. The wait stays interruptible, so a server whose daemon died can still be signalled out. For ublk_ctrl_start_dev() this replaces the fail-fast -EINVAL on an F_BATCH ready->UNPREP regression with waiting until the device is ready again.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/432a9b2780c0a01caf547bd1fc2fcf28aeb8d173
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7dd26adf7e7d482af524e3a0cca4a81ef7c159d0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8f188dd11a1c2ad94caeaee36ef68bb8221d4a12

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/ublk_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7dd26adf7e7d482af524e3a0cca4a81ef7c159d0",
              "status": "affected",
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "versionType": "git"
            },
            {
              "lessThan": "8f188dd11a1c2ad94caeaee36ef68bb8221d4a12",
              "status": "affected",
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "versionType": "git"
            },
            {
              "lessThan": "432a9b2780c0a01caf547bd1fc2fcf28aeb8d173",
              "status": "affected",
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "42ea64e01c96e594fb4f80c54dfe4f934d008a6e",
              "versionType": "git"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/ublk_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: wait on ublk_dev_ready() instead of ub-\u003ecompletion\n\nub-\u003ecompletion is only re-armed by a successful START_USER_RECOVERY. If\nthe ublk server sends END_USER_RECOVERY without one - e.g. its START\nfailed with -EBUSY and the error was ignored - the wait is satisfied by\nthe stale completion of the previous recovery cycle, and the device is\nmarked LIVE and the requeue list kicked while the FETCH stream is still\nrunning and ubq-\u003ecanceling is still set. The kick redispatches a\npreviously requeued request, __ublk_queue_rq_common() sees -\u003ecanceling\nand parks it again via __ublk_abort_rq(), and after the last FETCH\nclears -\u003ecanceling nothing ever kicks the requeue list again: the\nrequest is stranded there while holding its tag. If it is the flush\nmachinery\u0027s flush_rq, every subsequent fsync piles up in uninterruptible\nsleep and teardown hangs on tag draining. This matches a report of a\nlost PREFLUSH with ext4 on top of ublk after daemon crash recovery.\n\nub-\u003ecompletion is an edge-triggered latch used as a proxy for the level\ncondition \"every queue has fetched all I/O commands\", which can regress\n(F_BATCH\u0027s UNPREP, daemon death) and whose re-arm can be skipped. Drop\nit and wait on the real condition instead: the new helper\nublk_wait_dev_ready_and_lock() waits on ublk_dev_ready() via\nwait_var_event_interruptible(), woken from ublk_mark_io_ready(), then\nre-checks it under ub-\u003emutex, waiting again on regression, and returns\nwith the mutex held and readiness guaranteed.\n\nReadiness becomes true in the same ub-\u003emutex critical section that\nclears the last queue\u0027s -\u003ecanceling, so END_USER_RECOVERY marks the\ndevice LIVE and kicks the requeue list strictly after -\u003ecanceling\nclears. The wait stays interruptible, so a server whose daemon died can\nstill be signalled out. For ublk_ctrl_start_dev() this replaces the\nfail-fast -EINVAL on an F_BATCH ready-\u003eUNPREP regression with waiting\nuntil the device is ready again."
    }
  ],
  "id": "CVE-2026-68173",
  "lastModified": "2026-08-17T05:18:18.770",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-10T13:20:04.067",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/432a9b2780c0a01caf547bd1fc2fcf28aeb8d173"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7dd26adf7e7d482af524e3a0cca4a81ef7c159d0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8f188dd11a1c2ad94caeaee36ef68bb8221d4a12"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-68173 (GCVE-0-2026-68173)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-17 05:00

Title

ublk: wait on ublk_dev_ready() instead of ub->completion

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/7dd26adf7e7d482af…
https://git.kernel.org/stable/c/8f188dd11a1c2ad94…
https://git.kernel.org/stable/c/432a9b2780c0a01ca…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b , < 7dd26adf7e7d482af524e3a0cca4a81ef7c159d0 (git) Affected: 728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b , < 8f188dd11a1c2ad94caeaee36ef68bb8221d4a12 (git) Affected: 728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b , < 432a9b2780c0a01caf547bd1fc2fcf28aeb8d173 (git) Affected: 42ea64e01c96e594fb4f80c54dfe4f934d008a6e (git) Affected: 6.14.6 , < 6.15 (semver)
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/ublk_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7dd26adf7e7d482af524e3a0cca4a81ef7c159d0",
              "status": "affected",
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "versionType": "git"
            },
            {
              "lessThan": "8f188dd11a1c2ad94caeaee36ef68bb8221d4a12",
              "status": "affected",
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "versionType": "git"
            },
            {
              "lessThan": "432a9b2780c0a01caf547bd1fc2fcf28aeb8d173",
              "status": "affected",
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "42ea64e01c96e594fb4f80c54dfe4f934d008a6e",
              "versionType": "git"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/ublk_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: wait on ublk_dev_ready() instead of ub-\u003ecompletion\n\nub-\u003ecompletion is only re-armed by a successful START_USER_RECOVERY. If\nthe ublk server sends END_USER_RECOVERY without one - e.g. its START\nfailed with -EBUSY and the error was ignored - the wait is satisfied by\nthe stale completion of the previous recovery cycle, and the device is\nmarked LIVE and the requeue list kicked while the FETCH stream is still\nrunning and ubq-\u003ecanceling is still set. The kick redispatches a\npreviously requeued request, __ublk_queue_rq_common() sees -\u003ecanceling\nand parks it again via __ublk_abort_rq(), and after the last FETCH\nclears -\u003ecanceling nothing ever kicks the requeue list again: the\nrequest is stranded there while holding its tag. If it is the flush\nmachinery\u0027s flush_rq, every subsequent fsync piles up in uninterruptible\nsleep and teardown hangs on tag draining. This matches a report of a\nlost PREFLUSH with ext4 on top of ublk after daemon crash recovery.\n\nub-\u003ecompletion is an edge-triggered latch used as a proxy for the level\ncondition \"every queue has fetched all I/O commands\", which can regress\n(F_BATCH\u0027s UNPREP, daemon death) and whose re-arm can be skipped. Drop\nit and wait on the real condition instead: the new helper\nublk_wait_dev_ready_and_lock() waits on ublk_dev_ready() via\nwait_var_event_interruptible(), woken from ublk_mark_io_ready(), then\nre-checks it under ub-\u003emutex, waiting again on regression, and returns\nwith the mutex held and readiness guaranteed.\n\nReadiness becomes true in the same ub-\u003emutex critical section that\nclears the last queue\u0027s -\u003ecanceling, so END_USER_RECOVERY marks the\ndevice LIVE and kicks the requeue list strictly after -\u003ecanceling\nclears. The wait stays interruptible, so a server whose daemon died can\nstill be signalled out. For ublk_ctrl_start_dev() this replaces the\nfail-fast -EINVAL on an F_BATCH ready-\u003eUNPREP regression with waiting\nuntil the device is ready again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via io_uring commands (UBLK_CMD_END_USER_RECOVERY/UBLK_CMD_START_DEV) on /dev/ublk-control or ublk char devices; there is no network, Bluetooth, or physical-bus entry path to the vulnerable wait/completion logic.\nAC:L - An actor controlling the ublk server can reliably trigger stale-completion early wakeup by calling END_USER_RECOVERY after START_USER_RECOVERY failed (e.g., -EBUSY) without re-arming completion; the attacker controls both sides of the recovery sequence and needs no uncontrollable timing.\nPR:L - Recovery requires UBLK_F_USER_RECOVERY devices managed through ublk-control, which needs CAP_SYS_ADMIN for privileged devices; per kernel CNA guidance, CAP_SYS_ADMIN obtainable in a user namespace (unshare -Urn) counts as Low, not High.\nUI:N - Exploitation is driven by the ublk daemon issuing recovery/start control commands during crash recovery or restart; no end-user action such as opening files, mounting media, or clicking prompts is required.\nS:U - Impact is confined to the kernel block/ublk stack and filesystems backed by the affected ublk device; it does not cross VM, container, or IOMMU boundaries into a separate security authority.\nC:N - This is a state-machine/completion synchronization flaw, not memory corruption; it strands block requests and breaks flush barriers but does not read or disclose kernel or user memory.\nI:H - Premature END_USER_RECOVERY can strand the block layer flush_rq and lose PREFLUSH ordering (reported with ext4), breaking durability guarantees and allowing arbitrary user data loss or corruption after crash or power loss.\nA:H - Stranded flush_rq holds its MQ tag indefinitely, causing every subsequent fsync to sleep uninterruptibly (D state) and device teardown to hang on tag draining, producing a persistent kernel-level denial of service on the backing block device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:00:14.047Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7dd26adf7e7d482af524e3a0cca4a81ef7c159d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f188dd11a1c2ad94caeaee36ef68bb8221d4a12"
        },
        {
          "url": "https://git.kernel.org/stable/c/432a9b2780c0a01caf547bd1fc2fcf28aeb8d173"
        }
      ],
      "title": "ublk: wait on ublk_dev_ready() instead of ub-\u003ecompletion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68173",
    "datePublished": "2026-08-10T11:59:42.889Z",
    "dateReserved": "2026-07-30T09:28:09.372Z",
    "dateUpdated": "2026-08-17T05:00:14.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-68173

CVE-2026-68173 (GCVE-0-2026-68173)

Tags

Sightings

Nomenclature