CVE-2026-90323

In the Linux kernel, the following vulnerability has been resolved:

ublk: validate auto buf reg before taking uring_cmd

With UBLK_F_AUTO_BUF_REG, invalid sqe->addr can fail after

ublk_fill_io_cmd() has set UBLK_IO_FLAG_ACTIVE. The uring_cmd is

completed while the tag stays active, which can hang teardown.

Split validation from buffer apply so the check has no side effects,

then take the uring_cmd and store the already-validated buffer. Apply

the same order in FETCH so io->buf is not written before __ublk_fetch()

state checks.