CVE-2026-45975: Linux Kernel Race Condition Vulnerability

CVE-2026-45975 Overview

CVE-2026-45975 is a race condition vulnerability in the Linux kernel's ublk (userspace block device) subsystem. The flaw stems from unsafe access to struct ublksrv_ctrl_cmd, which resides within an io_uring_sqe mapped into userspace memory. The kernel reads fields from this structure using normal loads, while userspace can concurrently modify the same memory. This creates a time-of-check to time-of-use (TOCTOU) condition where field values can change between accesses. The fix applies READ_ONCE() to atomically copy the control command to a kernel stack buffer before use.

Critical Impact
Concurrent userspace writes to shared io_uring_sqe memory can produce inconsistent reads inside the kernel ublk driver, leading to undefined behavior in privileged control paths.

Affected Products

Linux kernel ublk driver (userspace block device subsystem)
Kernel versions prior to the commits referenced in the stable tree fixes
Distributions shipping affected stable kernels

Discovery Timeline

2026-05-27 - CVE-2026-45975 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45975

Vulnerability Analysis

The ublk driver exposes a control interface through io_uring. Each submission queue entry (io_uring_sqe) sits in memory that is shared between the kernel and userspace through a memory mapping. When the kernel handles a ublk control command, it reads fields directly from struct ublksrv_ctrl_cmd embedded inside the io_uring_sqe. Because userspace retains write access to that mapping, a malicious or buggy program can modify the structure after the kernel has begun processing it. Normal C memory accesses do not guarantee single-load semantics, so the compiler may read the same field multiple times and observe different values on each read.

Root Cause

The driver used plain loads to access fields of ublksrv_ctrl_cmd rather than READ_ONCE(). This is a classic double-fetch pattern in kernel code that handles user-shared memory [CWE-367]. Validation performed against one observed value does not constrain subsequent reads of the same field. The patch resolves this by using READ_ONCE() to copy the structure to the kernel stack once, then operating exclusively on the local copy.

Attack Vector

An attacker with the ability to submit io_uring operations against a ublk control file descriptor can race the kernel by repeatedly mutating fields of the shared ublksrv_ctrl_cmd while submissions are in flight. Successful timing produces inconsistent state inside the kernel control path. The fix is documented in the upstream stable commits ce63eda3e6d3 and ed9f54cc1e33. No public proof-of-concept code is associated with this CVE, and no exploitation in the wild has been reported.

Detection Methods for CVE-2026-45975

Indicators of Compromise

No public indicators of compromise have been published for this vulnerability.
Anomalous kernel log entries referencing the ublk driver during heavy io_uring activity may warrant review.

Detection Strategies

Inventory hosts running kernels that include the ublk driver and confirm whether the module is loaded with lsmod | grep ublk.
Track kernel package versions against vendor advisories for the stable backport containing commits ce63eda3e6d3 and ed9f54cc1e33.
Audit which workloads use ublk control commands through io_uring, since legitimate consumers are limited.

Monitoring Recommendations

Forward kernel ring buffer messages (dmesg) and auditd events to a centralized log store for review.
Monitor for unexpected ublk device creation or control activity originating from non-administrative processes.
Alert on kernel oops or warning traces that reference ublk_ctrl functions.

How to Mitigate CVE-2026-45975

Immediate Actions Required

Apply the stable kernel update that includes the upstream fix commits referenced in the NVD entry.
Where patching is not yet possible, unload the ublk driver on systems that do not require it using modprobe -r ublk_drv.
Restrict io_uring usage through sysctl kernel.io_uring_disabled where the workload permits.

Patch Information

The upstream Linux kernel fix replaces direct field access on struct ublksrv_ctrl_cmd with READ_ONCE() semantics, copying the structure to the kernel stack before use. The fix is available in the stable tree via commits ce63eda3e6d3 and ed9f54cc1e33. Consult your distribution's security tracker for the corresponding backported package version.

Workarounds

Blacklist the ublk_drv module on systems that do not require userspace block devices.
Limit io_uring access to trusted processes using seccomp filters or the io_uring_disabled sysctl.
Restrict access to the ublk control device path to administrative users only.

bash

# Disable the ublk driver until a patched kernel is deployed
echo 'blacklist ublk_drv' | sudo tee /etc/modprobe.d/blacklist-ublk.conf
sudo modprobe -r ublk_drv

# Optionally restrict io_uring system-wide (kernel 6.6+)
sudo sysctl -w kernel.io_uring_disabled=2