Linux Kernel up to 7.0.9 ublk privilege escalation

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.0.9 and classified as critical. This affects an unknown part of the component ublk. The manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2026-53124. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.0.9 and classified as critical. This issue affects an unknown part of the component ublk. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ublk: reset per-IO canceled flag on each fetch If a ublk server starts recovering devices but dies before issuing fetch commands for all IOs, cancellation of the fetch commands that were successfully issued may never complete. This is because the per-IO canceled flag can remain set even after the fetch for that IO has been submitted - the per-IO canceled flags for all IOs in a queue are reset together only once all IOs for that queue have been fetched. So if a nonempty proper subset of the IOs for a queue are fetched when the ublk server dies, the IOs in that subset will never successfully be canceled, as their canceled flags remain set, and this prevents ublk_cancel_cmd from actually calling io_uring_cmd_done on the commands, despite the fact that they are outstanding. Fix this by resetting the per-IO cancel flags immediately when each IO is fetched instead of waiting for all IOs for the queue (which may never happen).

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-53124 since 06/09/2026. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/24/2026).

Upgrading to version 7.0.10 eliminates this vulnerability. Applying the patch 63335e5a67d89bb7cb9b023bbb3785896587a648/0842186d2c4e67d2f8c8c2d1d779e8acffd41b5b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion