CVE-2026-22995: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-22995 is a use-after-free (UAF) vulnerability in the Linux kernel's ublk (userspace block device) subsystem, specifically in the ublk_partition_scan_work function. It was published on January 23, 2026, and affects Linux kernel versions 6.18.4 through 6.18.6 (exclusive) and 6.19-rc4. The vulnerability arises from a race condition between the asynchronous partition scan worker and device teardown, causing the worker to dereference a freed disk pointer. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free). The race condition occurs in three stages: (1) ublk_ctrl_start_dev() schedules partition_scan_work after add_disk(); (2) ublk_stop_dev() calls ublk_stop_dev_unlocked(), which invokes del_gendisk(), sets ub->ub_disk = NULL via ublk_detach_disk(), and then calls put_disk() which may free the disk structure; (3) the ublk_partition_scan_work worker subsequently dereferences the now-freed ub->ub_disk pointer, triggering the UAF. The attack vector is local and requires low privileges with no user interaction. The fix introduces reference counting via ublk_get_disk()/ublk_put_disk() in the worker, with a spinlock synchronizing against ublk_detach_disk(), and replaces flush_work() with cancel_work_sync() to prevent unnecessary execution after disk detachment (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation of this vulnerability could result in kernel crashes, memory corruption, or potentially kernel-level code execution if the freed memory is reallocated and controlled by an attacker. All three security dimensions — confidentiality, integrity, and availability — are rated High under CVSS v3.1, reflecting the potential for complete kernel compromise. The vulnerability is limited to local access on systems running affected kernel versions with the ublk subsystem active (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported (Red Hat Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing use-after-free or null pointer dereference errors in the ublk subsystem, such as messages referencing ublk_partition_scan_work or ub->ub_disk.
• Process: Unexpected kernel panics or oops messages triggered during ublk device start/stop cycles.
• System Behavior: Sudden system instability or crashes correlated with ublk device teardown operations, particularly when partition scanning is active.

Apply the upstream kernel patches available at the official kernel stable repository (commits 72e28774e9644c2bdbb4920842fbf77103a15a85 and f0d385f6689f37a2828c686fb279121df006b4cb), which fix the race condition by introducing proper reference counting and replacing flush_work() with cancel_work_sync(). Red Hat has tracked this issue under Bug ID 2432379 and users should apply kernel updates as they become available from their distribution. As a temporary workaround, minimizing the frequency of ublk device start/stop cycles reduces the exploitation window. Monitor kernel logs for ublk-related memory errors or crashes as an indicator of potential exploitation attempts (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

The vulnerability received standard automated tracking coverage from vulnerability aggregators such as VulnDB, Vulners, and CVEFeed shortly after publication. Social media activity was limited to automated CVE notification accounts on platforms such as Bluesky and Mastodon/infosec.exchange. No notable researcher commentary or significant media coverage has been identified beyond routine vulnerability database entries (Red Hat Advisory).