PT-2026-4495 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-01-24 · CVE-2026-22995

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A race condition can lead to a use-after-free issue within the ublk subsystem. Specifically, the vulnerability occurs between the asynchronous partition scan work and device teardown, potentially dereferencing a freed disk object (ub->ub disk). This happens when the partition scan work worker attempts to access ub->ub disk after it has been set to NULL or freed during device teardown. The issue arises from a lack of proper synchronization between the partition scan work and the device detachment process. The fix involves using ublk get disk() and ublk put disk() to maintain a reference to the disk within the worker, ensuring it either obtains a valid reference or exits early if the disk is no longer available. Additionally, flush work() has been changed to cancel work sync() to prevent unnecessary execution of the partition scan work when the disk is detached.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-22995

Affected Products

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22995.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22995 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22995 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22995 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-22995 · Security Note
• https://git.kernel.org/stable/c/f0d385f6689f37a2828c686fb279121df006b4cb · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-22995 · Vendor Advisory
• https://git.kernel.org/stable/c/72e28774e9644c2bdbb4920842fbf77103a15a85 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22995 · Vendor Advisory
• https://twitter.com/CVEnew/status/2014995849395437761 · Twitter Post
• https://git.kernel.org/linus/f0d385f6689f37a2828c686fb279121df006b4cb · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/vuldb/status/2014744957580689907 · Twitter Post