{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()  ublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into ub-\u003edev_info and then fixes up the fields the driver owns, but misses -\u003estate and -\u003eublksrv_pid.  A device added with -\u003estate = UBLK_S_DEV_LIVE passes the \"-\u003estate != UBLK_S_DEV_DEAD\" test that ublk_stop_dev_unlocked() uses as its proxy for \"a disk is attached\", while -\u003eub_disk is still NULL, so DEL_DEV right after ADD_DEV oopses in del_gendisk().  UBLK_S_DEV_QUIESCED plus UBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev().  A poisoned -\u003estate also gets START_USER_RECOVERY and the char device read/write path onto a device that was never started, and wedges START_DEV at -EEXIST.  A poisoned -\u003eublksrv_pid just makes GET_DEV_INFO report an unrelated task as the ublk server.  Reset both after the memcpy(), as ublk_detach_disk() does.  Userspace only ever reads these back, so correcting them silently breaks nothing.  ADD_DEV has copied -\u003estate in unsanitized since ublk was merged, but back then it was harmless: the gendisk was allocated during ADD_DEV, and both teardown and the START_DEV -EEXIST check keyed off disk_live() rather than -\u003estate.  The oops became reachable once the disk allocation moved to START_DEV and those checks switched to -\u003estate.",
  "id": "DEBIAN-CVE-2026-74472",
  "modified": "2026-09-19T21:47:34.490887712Z",
  "published": "2026-08-15T13:17:51.953Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74472"
    }
  ],
  "upstream": [
    "CVE-2026-74472"
  ]
}