CVE-2026-90324 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

ublk: check import_ubuf() return value

import_ubuf() can fail if the address range (provided by the userspace
ublk server) is outside the allowed user address space. Return that 0
bytes were copied if import_ubuf() fails rather than passing an
uninitialized struct iov_iter to ublk_copy_user_pages().

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/0121c84adb6a4cd6f7560b5895bd88f9899bbc1f
https://git.kernel.org/stable/c/3831568792af75b6523fa93bb91560e29189cf55
https://git.kernel.org/stable/c/5ac6019cb78e98c9608fda72726b36ddf8474dd7

History

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ublk: check import_ubuf() return value import_ubuf() can fail if the address range (provided by the userspace ublk server) is outside the allowed user address space. Return that 0 bytes were copied if import_ubuf() fails rather than passing an uninitialized struct iov_iter to ublk_copy_user_pages().
Title		ublk: check import_ubuf() return value
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0121c84adb6a4cd6f7560b5895bd88f9899bbc1f https://git.kernel.org/stable/c/3831568792af75b6523fa93bb91560e29189cf55 https://git.kernel.org/stable/c/5ac6019cb78e98c9608fda72726b36ddf8474dd7

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:08:40.077Z

Updated: 2026-09-17T16:08:40.077Z

Reserved: 2026-09-11T19:38:34.802Z

Link: CVE-2026-90324

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:30.410

Modified: 2026-09-17T17:17:30.410

Link: CVE-2026-90324

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90324", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.802Z", "datePublished": "2026-09-17T16:08:40.077Z", "dateUpdated": "2026-09-17T16:08:40.077Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-17T16:08:40.077Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: check import_ubuf() return value\n\nimport_ubuf() can fail if the address range (provided by the userspace\nublk server) is outside the allowed user address space. Return that 0\nbytes were copied if import_ubuf() fails rather than passing an\nuninitialized struct iov_iter to ublk_copy_user_pages()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/block/ublk_drv.c"], "versions": [{"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648", "lessThan": "0121c84adb6a4cd6f7560b5895bd88f9899bbc1f", "status": "affected", "versionType": "git"}, {"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648", "lessThan": "5ac6019cb78e98c9608fda72726b36ddf8474dd7", "status": "affected", "versionType": "git"}, {"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648", "lessThan": "3831568792af75b6523fa93bb91560e29189cf55", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/block/ublk_drv.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0121c84adb6a4cd6f7560b5895bd88f9899bbc1f"}, {"url": "https://git.kernel.org/stable/c/5ac6019cb78e98c9608fda72726b36ddf8474dd7"}, {"url": "https://git.kernel.org/stable/c/3831568792af75b6523fa93bb91560e29189cf55"}], "title": "ublk: check import_ubuf() return value", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/block/ublk_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0121c84adb6a4cd6f7560b5895bd88f9899bbc1f", "status": "affected", "version": "981f95a571e3ca20a496c0b77dbf6b06039c6648", "versionType": "git"}, {"lessThan": "5ac6019cb78e98c9608fda72726b36ddf8474dd7", "status": "affected", "version": "981f95a571e3ca20a496c0b77dbf6b06039c6648", "versionType": "git"}, {"lessThan": "3831568792af75b6523fa93bb91560e29189cf55", "status": "affected", "version": "981f95a571e3ca20a496c0b77dbf6b06039c6648", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/block/ublk_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: check import_ubuf() return value\n\nimport_ubuf() can fail if the address range (provided by the userspace\nublk server) is outside the allowed user address space. Return that 0\nbytes were copied if import_ubuf() fails rather than passing an\nuninitialized struct iov_iter to ublk_copy_user_pages()."}], "id": "CVE-2026-90324", "lastModified": "2026-09-17T17:17:30.410", "metrics": {}, "published": "2026-09-17T17:17:30.410", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0121c84adb6a4cd6f7560b5895bd88f9899bbc1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3831568792af75b6523fa93bb91560e29189cf55"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5ac6019cb78e98c9608fda72726b36ddf8474dd7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}