Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-37906

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may have scheduled task work via io_uring_cmd_complete_in_task() for dispatching request, then kernel crash can be triggered. Fix it by not trying to canceling the command if ublk block request is started.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 216c8f5ef0f209a3797292c487bdaa6991ab4b92 to < 346b7d74c612234dae0878892682b9722e7c04c8affected
  • 216c8f5ef0f209a3797292c487bdaa6991ab4b92 to < fb2eb9ddf556f93fef45201e1f9d2b8674bcc975affected
  • 216c8f5ef0f209a3797292c487bdaa6991ab4b92 to < f40139fde5278d81af3227444fd6e76a76b9506daffected

Linux Linux

Default version status: affected

  • 6.7affected
  • 0 to < 6.7unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.14.6 to ≤ 6.14.*unaffected
  • 6.15 to ≤ *unaffected

References