{"id":"CVE-2026-22995","summary":"ublk: fix use-after-free in ublk_partition_scan_work","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: fix use-after-free in ublk_partition_scan_work\n\nA race condition exists between the async partition scan work and device\nteardown that can lead to a use-after-free of ub-\u003eub_disk:\n\n1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()\n2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:\n   - del_gendisk(ub-\u003eub_disk)\n   - ublk_detach_disk() sets ub-\u003eub_disk = NULL\n   - put_disk() which may free the disk\n3. The worker ublk_partition_scan_work() then dereferences ub-\u003eub_disk\n   leading to UAF\n\nFix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold\na reference to the disk during the partition scan. The spinlock in\nublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker\neither gets a valid reference or sees NULL and exits early.\n\nAlso change flush_work() to cancel_work_sync() to avoid running the\npartition scan work unnecessarily when the disk is already detached.","modified":"2026-08-12T03:51:49.168857423Z","published":"2026-01-23T15:24:15.684Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22995.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/72e28774e9644c2bdbb4920842fbf77103a15a85"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f0d385f6689f37a2828c686fb279121df006b4cb"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22995.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22995"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"63dfbcd59b4b823eac4441efff10b1c303c8f49f"},{"fixed":"72e28774e9644c2bdbb4920842fbf77103a15a85"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a"},{"fixed":"f0d385f6689f37a2828c686fb279121df006b4cb"}]}],"versions":["v6.18.5","v6.18.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22995.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.18.4"},{"fixed":"6.18.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22995.json"}}],"schema_version":"1.9.0"}