CVE-2026-22995: In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the…

PriorityP339high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.11%

1.8th percentile

In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ub_disk: 1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk() 2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does: - del_gendisk(ub->ub_disk) - ublk_detach_disk() sets ub->ub_disk = NULL - put_disk() which may free the disk 3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk leading to UAF Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold a reference to the disk during the partition scan. The spinlock in ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker either gets a valid reference or sees NULL and exits early. Also change flush_work() to cancel_work_sync() to avoid running the partition scan work unnecessarily when the disk is already detached.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.18.8-1 (forky)	linux 6.18.8-1 (forky)
linux	linux	>= 6.18.4 < 6.18.6	6.18.6
linux	linux	>= 63dfbcd59b4b823eac4441efff10b1c303c8f49f < 72e28774e9644c2bdbb4920842fbf77103a15a85	72e28774e9644c2bdbb4920842fbf77103a15a85
linux	linux	>= 7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a < f0d385f6689f37a2828c686fb279121df006b4cb	f0d385f6689f37a2828c686fb279121df006b4cb
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.18.8-1	6.18.8-1
linux	linux_kernel	>= 6.18.4 < 6.18.6	6.18.6

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv7.8HIGH

vendor_debian7.8LOW

vendor_redhat7.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.