Linux Kernel CVE-2026-45975

The ublk subsystem enables userspace-implemented block devices via the io_uring asynchronous I/O interface. The ublksrv_ctrl_cmd struct is embedded within the io_uring_sqe (submission queue entry), which lives in memory shared between the kernel and userspace via a memory-mapped ring buffer. Because the kernel previously read individual fields of ublksrv_ctrl_cmd using ordinary C loads - rather than atomic, compiler-barrier-protected reads - a concurrent userspace thread could legally modify those fields between kernel reads of different struct members, producing a time-of-check-time-of-use (TOCTOU) inconsistency. While no CWE is formally assigned, this maps to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). The fix copies the entire struct to a local stack variable using READ_ONCE() before any field is accessed, ensuring the kernel operates on a consistent snapshot isolated from concurrent userspace writes. Affected CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.