CVE-2026-45962

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Memory Access in Linux Kernel ublk

Publication date: 2026-05-27

Last updated on: 2026-06-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ublk: Validate SQE128 flag before accessing the cmd ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before IO_URING_F_SQE128 flag check. This could cause out of boundary memory access. Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-16

Generated

2026-07-06

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45962

EUVD

EUVD-2026-32246

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.128 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.75 (exc)
linux	linux_kernel	From 6.0 (inc) to 6.1.165 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been resolved by validating the SQE128 flag before accessing the cmd in the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix, which moves the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not set.

Executive Summary

This vulnerability exists in the Linux kernel's ublk component. Specifically, the function ublk_ctrl_cmd_dump() accesses a command pointer (cmd) before verifying if the IO_URING_F_SQE128 flag is set. Because the flag check happens too late, this can lead to out-of-boundary memory access, which is a form of memory corruption.

The fix involved moving the SQE128 flag check earlier in the ublk_ctrl_uring_cmd() function to immediately return an error (-EINVAL) if the flag is not set, preventing the unsafe memory access.

Impact Analysis

This vulnerability can lead to out-of-boundary memory access in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges depending on the context in which the vulnerable code is used.

Hi! I’m here to help you understand CVE-2026-45962. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70