Riskcovery

CVE-2025-37906

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

State
Published
Severity
7.8 High
Published
May 20, 2025
Updated
Oct 21, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may have scheduled task work via io_uring_cmd_complete_in_task() for dispatching request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is started.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 216c8f5ef0f209a3797292c487bdaa6991ab4b92 to before 346b7d74c612234dae0878892682b9722e7c04c8Affected
  • 216c8f5ef0f209a3797292c487bdaa6991ab4b92 to before fb2eb9ddf556f93fef45201e1f9d2b8674bcc975Affected
  • 216c8f5ef0f209a3797292c487bdaa6991ab4b92 to before f40139fde5278d81af3227444fd6e76a76b9506dAffected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.14.6 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.