{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-68173",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-68173",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-10T11:59:42.889Z",
    "updatedAt": "2026-08-17T05:00:14.047Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ublk: wait on ublk_dev_ready() instead of ub->completion",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: wait on ublk_dev_ready() instead of ub->completion\n\nub->completion is only re-armed by a successful START_USER_RECOVERY. If\nthe ublk server sends END_USER_RECOVERY without one - e.g. its START\nfailed with -EBUSY and the error was ignored - the wait is satisfied by\nthe stale completion of the previous recovery cycle, and the device is\nmarked LIVE and the requeue list kicked while the FETCH stream is still\nrunning and ubq->canceling is still set. The kick redispatches a\npreviously requeued request, __ublk_queue_rq_common() sees ->canceling\nand parks it again via __ublk_abort_rq(), and after the last FETCH\nclears ->canceling nothing ever kicks the requeue list again: the\nrequest is stranded there while holding its tag. If it is the flush\nmachinery's flush_rq, every subsequent fsync piles up in uninterruptible\nsleep and teardown hangs on tag draining. This matches a report of a\nlost PREFLUSH with ext4 on top of ublk after daemon crash recovery.\n\nub->completion is an edge-triggered latch used as a proxy for the level\ncondition \"every queue has fetched all I/O commands\", which can regress\n(F_BATCH's UNPREP, daemon death) and whose re-arm can be skipped. Drop\nit and wait on the real condition instead: the new helper\nublk_wait_dev_ready_and_lock() waits on ublk_dev_ready() via\nwait_var_event_interruptible(), woken from ublk_mark_io_ready(), then\nre-checks it under ub->mutex, waiting again on regression, and returns\nwith the mutex held and readiness guaranteed.\n\nReadiness becomes true in the same ub->mutex critical section that\nclears the last queue's ->canceling, so END_USER_RECOVERY marks the\ndevice LIVE and kicks the requeue list strictly after ->canceling\nclears. The wait stays interruptible, so a server whose daemon died can\nstill be signalled out. For ublk_ctrl_start_dev() this replaces the\nfail-fast -EINVAL on an F_BATCH ready->UNPREP regression with waiting\nuntil the device is ready again.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7dd26adf7e7d482af524e3a0cca4a81ef7c159d0"
            },
            {
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "status": "affected",
              "versionType": "git",
              "lessThan": "8f188dd11a1c2ad94caeaee36ef68bb8221d4a12"
            },
            {
              "version": "728cbac5fe219d3b8a21a0688a08f2b7f8aeda2b",
              "status": "affected",
              "versionType": "git",
              "lessThan": "432a9b2780c0a01caf547bd1fc2fcf28aeb8d173"
            },
            {
              "version": "42ea64e01c96e594fb4f80c54dfe4f934d008a6e",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "6.14.6",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.15"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.15",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.15"
            },
            {
              "version": "6.18.42",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.1.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}