In the Linux kernel, the following vulnerability has been resolved:

ublk: Validate SQE128 flag before accessing the cmd

ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before
IO_URING_F_SQE128 flag check. This could cause out of boundary memory
access.

Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return
-EINVAL immediately if the flag is not set.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
71f28f3136aff5890cd56de78abc673f8393cad9 affected < 4b4dff498f46e9802f71bc84258bf73065f51c6a
71f28f3136aff5890cd56de78abc673f8393cad9 affected < 31cac6acf77ece488f29fb8f79589d9298e969c8
71f28f3136aff5890cd56de78abc673f8393cad9 affected < dbe8e81a2ec608f87f79a34f6444cd62f6a243bb
71f28f3136aff5890cd56de78abc673f8393cad9 affected < f75a5555e0049e7857eae25b60aee98b80e287ec
71f28f3136aff5890cd56de78abc673f8393cad9 affected < 17d33ba7291100008360b5a354962db37ad80684
71f28f3136aff5890cd56de78abc673f8393cad9 affected < da7e4b75e50c087d2031a92f6646eb90f7045a67
Linux Linux affected
Version Status Constraints
6.0 affected —
0 unaffected < 6.0
6.1.165 unaffected ≤ 6.1.*
6.6.128 unaffected ≤ 6.6.*
6.12.75 unaffected ≤ 6.12.*
6.18.14 unaffected ≤ 6.18.*
6.19.4 unaffected ≤ 6.19.*
7.0 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/17d33ba7291100008360b5a354962db37ad80684 cve-icon cve-icon
https://git.kernel.org/stable/c/31cac6acf77ece488f29fb8f79589d9298e969c8 cve-icon cve-icon
https://git.kernel.org/stable/c/4b4dff498f46e9802f71bc84258bf73065f51c6a cve-icon cve-icon
https://git.kernel.org/stable/c/da7e4b75e50c087d2031a92f6646eb90f7045a67 cve-icon cve-icon
https://git.kernel.org/stable/c/dbe8e81a2ec608f87f79a34f6444cd62f6a243bb cve-icon cve-icon
https://git.kernel.org/stable/c/f75a5555e0049e7857eae25b60aee98b80e287ec cve-icon cve-icon
History

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ublk: Validate SQE128 flag before accessing the cmd ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before IO_URING_F_SQE128 flag check. This could cause out of boundary memory access. Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not set.
Title ublk: Validate SQE128 flag before accessing the cmd
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:18:19.070Z

Reserved: 2026-05-13T15:03:33.089Z

Link: CVE-2026-45962

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:12.917

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-45962

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.