CVE-2026-45962: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45962 Overview

CVE-2026-45962 affects the Linux kernel's userspace block driver (ublk) subsystem. The function ublk_ctrl_cmd_dump() dereferences (header *)sqe->cmd before validating the IO_URING_F_SQE128 flag. When the flag is not set, the submission queue entry (SQE) is the standard 64-byte size, but the code accesses memory as if it were the extended 128-byte format. This results in out-of-bounds memory access during io_uring control command processing. The upstream fix moves the SQE128 flag check earlier in ublk_ctrl_uring_cmd() so that the kernel returns -EINVAL immediately when the flag is absent.

Critical Impact
A local user issuing an io_uring control command against ublk without the IO_URING_F_SQE128 flag can trigger an out-of-bounds read in kernel memory.

Affected Products

Linux kernel versions containing the ublk driver with ublk_ctrl_cmd_dump() prior to the referenced stable commits
Distributions shipping affected mainline and stable kernel branches
Systems with io_uring and ublk enabled and accessible to local users

Discovery Timeline

2026-05-27 - CVE-2026-45962 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45962

Vulnerability Analysis

The ublk subsystem provides a userspace block device interface that uses io_uring for command submission. Control commands flow through ublk_ctrl_uring_cmd(), which dispatches to helpers including ublk_ctrl_cmd_dump(). The dump helper casts sqe->cmd to a header pointer and reads fields from it.

The IO_URING_F_SQE128 flag signals that the submission queue entry occupies 128 bytes instead of the default 64 bytes. The extended layout is required to embed a full ublk command header inside the SQE. Without the flag, the trailing 64 bytes that the kernel reads as cmd payload lie outside the SQE buffer.

Because the original code accessed sqe->cmd before checking the flag, an attacker submitting a malformed control command could induce a kernel out-of-bounds read [CWE-125]. The read can disclose adjacent kernel memory contents or, depending on allocator layout, trigger a fault.

Root Cause

The ordering of validation and pointer dereference in ublk_ctrl_uring_cmd() was incorrect. The flag check that gates use of the extended SQE format ran after the helper had already cast and read from sqe->cmd. Trust was placed in the caller-controlled SQE layout before verifying the precondition that guarantees the buffer is large enough.

Attack Vector

Exploitation requires local access and the ability to open the ublk control device and submit io_uring commands. An attacker constructs an SQE without setting IO_URING_F_SQE128 and issues a ublk control command. The kernel reads beyond the 64-byte SQE, accessing memory that does not belong to the submission entry. No remote attack surface is exposed by this defect.

No public proof-of-concept code is referenced in the available data. The vulnerability is described in the upstream commit messages linked from the Linux kernel stable tree.

Detection Methods for CVE-2026-45962

Indicators of Compromise

KASAN (Kernel Address Sanitizer) reports citing ublk_ctrl_cmd_dump or ublk_ctrl_uring_cmd in the call stack
Unexpected EINVAL returns from io_uring control submissions targeting /dev/ublk-control on patched systems, indicating attempted misuse
Kernel oops or warning messages referencing ublk control command paths

Detection Strategies

Audit running kernel versions against the fixed commits 17d33ba, 31cac6a, 4b4dff4, da7e4b7, dbe8e81, and f75a555 to confirm patch presence
Enable kernel auditing on opens of /dev/ublk-control and correlate with non-privileged user activity
Monitor dmesg for KASAN or slab out-of-bounds reports involving io_uring submission queue processing

Monitoring Recommendations

Collect kernel crash dumps and syslog entries centrally to identify repeated ublk control command failures
Track which local accounts and containers have access to ublk devices and the io_uring syscall family
Alert on workloads that submit ublk control commands without the IO_URING_F_SQE128 flag, which indicates malformed usage

How to Mitigate CVE-2026-45962

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 17d33ba7291100008360b5a354962db37ad80684 and the related backports listed in the references
Restrict access to /dev/ublk-control and ublk block devices to trusted administrative accounts only
Disable the CONFIG_BLK_DEV_UBLK driver in kernel builds where userspace block devices are not required

Patch Information

The fix moves the IO_URING_F_SQE128 flag check earlier in ublk_ctrl_uring_cmd() so the function returns -EINVAL before any access to sqe->cmd. The patch is available in the following stable tree commits: 17d33ba, 31cac6a, 4b4dff4, da7e4b7, dbe8e81, and f75a555.

Workarounds

Unload the ublk_drv kernel module on systems that do not actively use userspace block devices
Use Linux capabilities and seccomp profiles to block the io_uring_setup and io_uring_enter syscalls for untrusted workloads
In container environments, drop CAP_SYS_ADMIN and prevent mounting of /dev/ublk-control into untrusted containers

bash

# Configuration example
# Unload the ublk driver if not in use
sudo modprobe -r ublk_drv

# Prevent automatic loading
echo 'blacklist ublk_drv' | sudo tee /etc/modprobe.d/blacklist-ublk.conf

# Verify the loaded kernel includes the fix
uname -r
grep -E 'ublk_ctrl_uring_cmd|ublk_ctrl_cmd_dump' /proc/kallsyms