{"id":"CVE-2026-53124","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: reset per-IO canceled flag on each fetch\n\nIf a ublk server starts recovering devices but dies before issuing fetch\ncommands for all IOs, cancellation of the fetch…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: reset per-IO canceled flag on each fetch\n\nIf a ublk server starts recovering devices but dies before issuing fetch\ncommands for all IOs, cancellation of the fetch…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.14.6, < 6.15","linux_kernel >= 6.15.1, < 7.0.10","linux_kernel = 6.15"],"patched":["linux_kernel 7.0.10"],"published":"2026-06-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:36.610","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53124","references":[{"url":"https://git.kernel.org/stable/c/0842186d2c4e67d2f8c8c2d1d779e8acffd41b5b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63335e5a67d89bb7cb9b023bbb3785896587a648","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de05e37d02f3f33ebca4967164e54f5fea809d86","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00143,"epssPercentile":0.0323,"ingestedAt":"2026-10-15T11:00:41.701Z","slug":"CVE-2026-53124","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nublk: reset per-IO canceled flag on each fetch\n\nIf a ublk server starts recovering devices but dies before issuing fetch\ncommands for all IOs, cancellation of the fetch commands that were\nsuccessfully issued may never complete. This is because the per-IO\ncanceled flag can remain set even after the fetch for that IO has been\nsubmitted - the per-IO canceled flags for all IOs in a queue are reset\ntogether only once all IOs for that queue have been fetched. So if a\nnonempty proper subset of the IOs for a queue are fetched when the ublk\nserver dies, the IOs in that subset will never successfully be canceled,\nas their canceled flags remain set, and this prevents ublk_cancel_cmd\nfrom actually calling io_uring_cmd_done on the commands, despite the\nfact that they are outstanding.\n\nFix this by resetting the per-IO cancel flags immediately when each IO\nis fetched instead of waiting for all IOs for the queue (which may never\nhappen).\n\n## Affected\n\n- `linux_kernel >= 6.14.6, < 6.15`\n- `linux_kernel >= 6.15.1, < 7.0.10`\n- `linux_kernel = 6.15`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.10`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222312,"id":"CVE-2026-53124","ts":1792065875317,"field":"cvss","old":null,"new":"5.5"},{"seq":222311,"id":"CVE-2026-53124","ts":1792065875317,"field":"severity","old":"none","new":"medium"}]}