CVE-2025-37906CWE-362

CVE-2025-37906

High · published May 20, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
4.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but

we may have scheduled task work via io_uring_cmd_complete_in_task() for

dispatching request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is

started.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.4th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2025-05-20T20:15Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 6.7, < 6.14.66.14.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
https://git.kernel.org/stable/c/346b7d74c612234dae0878892682b9722e7c04c8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f40139fde5278d81af3227444fd6e76a76b9506d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fb2eb9ddf556f93fef45201e1f9d2b8674bcc975 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 20 MAY 15:21Z
    ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
    cvelistv5