CVE-2026-22995

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix use-after-free in ublk_partition_scan_work

A race condition exists between the async partition scan work and device

teardown that can lead to a use-after-free of ub->ub_disk:

1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()

2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:

- del_gendisk(ub->ub_disk)

- ublk_detach_disk() sets ub->ub_disk = NULL

- put_disk() which may free the disk

3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk

leading to UAF

Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold

a reference to the disk during the partition scan. The spinlock in

ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker

either gets a valid reference or sees NULL and exits early.

Also change flush_work() to cancel_work_sync() to avoid running the

partition scan work unnecessarily when the disk is already de

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References