Linux Kernel CVE-2026-43364

Upgrade to patched Linux kernel versions 6.18.20, 6.19.9, 7.0 or later stable releases that include the NULL pointer check fix in ublk_ctrl_set_size(). Patches are available from the Linux kernel stable tree at https://git.kernel.org/stable/c/f13fe6794726755a43090cb680c4c58cea6aa5f1 (stable branch), https://git.kernel.org/stable/c/c28d945bfa92e15147e93b73f95345b9bec979b0 (alternate stable), and https://git.kernel.org/stable/c/25966fc097691e5c925ad080f64a2f19c5fd940a (mainline integration). If immediate patching is not feasible, restrict access to the ublk device interface by limiting user permissions to create or interact with ublk devices via appropriate udev rules or capability restrictions (CAP_SYS_ADMIN requirements). This compensating control reduces attack surface but does not eliminate risk if privileged processes interact with ublk devices on behalf of lower-privileged users. Alternatively, disable or blacklist the ublk kernel module if the userspace block device functionality is not required for operations (via /etc/modprobe.d/blacklist.conf entry for ublk_drv), though this prevents legitimate use of ublk features. Verify patch application by checking kernel version and confirming the presence of state validation in ublk_ctrl_set_size() via kernel source inspection or vendor security advisories.