Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-22995

In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ub_disk: 1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk() 2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does: - del_gendisk(ub->ub_disk) - ublk_detach_disk() sets ub->ub_disk = NULL - put_disk() which may free t
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d8b6e3f9a9c9b4569c17eb183be5c8a136b31cf6799e54701de7e71ee761dc48
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"72e28774e9644c2bdbb4920842fbf77103a15a85","status":"affected","version":"63dfbcd59b4b823eac4441efff10b1c303c8f49f","versionType":"git"},{"lessThan":"f0d385f6689f37a2828c686fb279121df006b4cb","status":"affected","version":"7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a","versionType":"git"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c4907be30437e638c76cfd7cf932c7e42308aedcea7c9fa607a7ec5cbe1134a2 · sha256:70b073f42fb666b9… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.6","status":"affected","version":"6.18.4","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c4907be30437e638c76cfd7cf932c7e42308aedcea7c9fa607a7ec5cbe1134a2 · sha256:70b073f42fb666b9… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"72e28774e9644c2bdbb4920842fbf77103a15a85","status":"affected","version":"63dfbcd59b4b823eac4441efff10b1c303c8f49f","versionType":"git"},{"lessThan":"f0d385f6689f37a2828c686fb279121df006b4cb","status":"affected","version":"7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a","versionType":"git"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c4907be30437e638c76cfd7cf932c7e42308aedcea7c9fa607a7ec5cbe1134a2 · sha256:70b073f42fb666b9… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.6","status":"affected","version":"6.18.4","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c4907be30437e638c76cfd7cf932c7e42308aedcea7c9fa607a7ec5cbe1134a2 · sha256:70b073f42fb666b9… · /containers/cna/affected/1

Source references

2 source assertions
{"url":"https://git.kernel.org/stable/c/72e28774e9644c2bdbb4920842fbf77103a15a85"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c4907be30437e638c76cfd7cf932c7e42308aedcea7c9fa607a7ec5cbe1134a2 · sha256:70b073f42fb666b9… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/f0d385f6689f37a2828c686fb279121df006b4cb"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c4907be30437e638c76cfd7cf932c7e42308aedcea7c9fa607a7ec5cbe1134a2 · sha256:70b073f42fb666b9… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer