Linux Kernel EUVD-2026-81985

Requires the ability to run or control a userspace ublk server bound to a ublk block device on the target host - i.e., ublk (CONFIG_BLK_DEV_UBLK) must be built/loaded and the actor must have permission to create/drive a ublk device (CAP_SYS_ADMIN by default, or a lower-privileged user only when the device was created with UBLK_F_UNPRIVILEGED_DEV). The trigger is a ublk-server-supplied user-buffer address range that lies outside the allowed user address space, causing import_ubuf() to fail. Limiting factors: no remote/network vector (local only), the ublk subsystem exists only in modern 6.x kernels and is not enabled/used on most general-purpose systems, and the primary observable outcome is a kernel crash rather than reliable code execution or data theft.

This is a Linux kernel ublk (userspace block driver) defensive-coding fix: the code failed to check the return value of import_ubuf(), so when a userspace ublk server supplied an address range outside the allowed user address space, an uninitialized struct iov_iter was passed onward to ublk_copy_user_pages(). The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) correctly captures the local, low-privilege, no-interaction attack surface, but the C:H/I:H/A:H impact is overstated: this is an error-path use-of-uninitialized-resource bug whose primary consequence is undefined behavior/crash (DoS), with only a marginal uninitialized-memory disclosure or misdirected-copy corruption angle. There is NO EPSS score, NO CISA KEV listing, and NO public exploit - consistent with no public exploit identified at time of analysis. There is no signal conflict on the network/local dimension (both CVSS vector and description agree this is a local ublk-server-triggered flaw), but the severity is inflated relative to the crash-primary technical reality. Realistic priority is moderate-to-low: patch on normal kernel-update cadence rather than as an emergency.

A local user who controls (or can run) a ublk userspace server intentionally submits a block request describing a user-buffer address range that lies outside the permitted user address space, forcing import_ubuf() to fail; the kernel then operates on an uninitialized iov_iter, producing a copy against an undefined target that typically crashes the kernel and could, in the worst case, read/write unintended memory. No public proof-of-concept is known, and exploitation requires the ability to operate a ublk device rather than a remote network path.