CVE-2025-37906 (GCVE-0-2025-37906)
Vulnerability from cvelistv5
Published
2025-05-20 15:21
Modified
2026-08-05 11:58
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may have scheduled task work via io_uring_cmd_complete_in_task() for dispatching request, then kernel crash can be triggered. Fix it by not trying to canceling the command if ublk block request is started.
References
Impacted products
Vendor Product Version
Linux Linux Version: 216c8f5ef0f209a3797292c487bdaa6991ab4b92
Version: 216c8f5ef0f209a3797292c487bdaa6991ab4b92
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/ublk_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fb2eb9ddf556f93fef45201e1f9d2b8674bcc975",
              "status": "affected",
              "version": "216c8f5ef0f209a3797292c487bdaa6991ab4b92",
              "versionType": "git"
            },
            {
              "lessThan": "f40139fde5278d81af3227444fd6e76a76b9506d",
              "status": "affected",
              "version": "216c8f5ef0f209a3797292c487bdaa6991ab4b92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/ublk_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd\n\nublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but\nwe may have scheduled task work via io_uring_cmd_complete_in_task() for\ndispatching request, then kernel crash can be triggered.\n\nFix it by not trying to canceling the command if ublk block request is\nstarted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is reached only through local interfaces \u2014 `/dev/ublk-control` and `/dev/ublkc*` io_uring passthrough commands plus block I/O to `/dev/ublkb*`. There is no remote or adjacent-network path into ublk_drv.\nAC:L - The attacker owns both sides of the race: one thread submits I/O to the ublk block device (queueing `ublk_cmd_tw_cb` task work) while another tears down the io_uring ring or issues `UBLK_CMD_STOP_DEV`, driving `ublk_cancel_cmd()`. The window can be hit repeatedly in a loop with high queue depth until it lands.\nPR:L - ublk explicitly supports `UBLK_F_UNPRIVILEGED_DEV`, where `ublk_ctrl_add_dev()` accepts non-`CAP_SYS_ADMIN` callers and all later control commands gate only on file permissions of `/dev/ublkc*`, so an ordinary local user (including inside a container) can create and drive the device. Only basic local-user access is needed, not real root.\nUI:N - The attacking process performs every step itself \u2014 creating the ublk device, issuing I/O, and triggering cancellation. No victim action or interaction is required.\nS:U - The corruption is confined to kernel heap objects (`io_kiocb`) within the same security authority; the ublk driver and io_uring both run in the kernel\u0027s own scope. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed io_uring request is dereferenced and re-completed, so an attacker who reclaims the slab object controls its contents and can have kernel data posted back through the CQE and the ublk io path. Per UAF guidance this constitutes a path to arbitrary kernel memory disclosure.\nI:H - The second `io_uring_cmd_done()` writes result fields into and relinks a freed `io_kiocb`, and the request is freed twice \u2014 a write-after-free plus double-free on a well-known io_uring slab that is a standard heap-spray target for control-flow hijack. This is high-integrity memory corruption, not a bounded write.\nA:H - The commit states plainly that \"kernel crash can be triggered,\" and the double completion corrupts io_uring\u0027s completion/task-work lists. Any unprivileged local user with a ublk device can panic the machine on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:13.306Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fb2eb9ddf556f93fef45201e1f9d2b8674bcc975"
        },
        {
          "url": "https://git.kernel.org/stable/c/f40139fde5278d81af3227444fd6e76a76b9506d"
        }
      ],
      "title": "ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37906",
    "datePublished": "2025-05-20T15:21:39.633Z",
    "dateReserved": "2025-04-16T04:51:23.966Z",
    "dateUpdated": "2026-08-05T11:58:13.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.