{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-37906",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:23.966Z",
        "datePublished": "2025-05-20T15:21:39.633Z",
        "dateUpdated": "2026-08-05T11:58:13.306Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:58:13.306Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd\n\nublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but\nwe may have scheduled task work via io_uring_cmd_complete_in_task() for\ndispatching request, then kernel crash can be triggered.\n\nFix it by not trying to canceling the command if ublk block request is\nstarted."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The race is reached only through local interfaces — `/dev/ublk-control` and `/dev/ublkc*` io_uring passthrough commands plus block I/O to `/dev/ublkb*`. There is no remote or adjacent-network path into ublk_drv.\nAC:L - The attacker owns both sides of the race: one thread submits I/O to the ublk block device (queueing `ublk_cmd_tw_cb` task work) while another tears down the io_uring ring or issues `UBLK_CMD_STOP_DEV`, driving `ublk_cancel_cmd()`. The window can be hit repeatedly in a loop with high queue depth until it lands.\nPR:L - ublk explicitly supports `UBLK_F_UNPRIVILEGED_DEV`, where `ublk_ctrl_add_dev()` accepts non-`CAP_SYS_ADMIN` callers and all later control commands gate only on file permissions of `/dev/ublkc*`, so an ordinary local user (including inside a container) can create and drive the device. Only basic local-user access is needed, not real root.\nUI:N - The attacking process performs every step itself — creating the ublk device, issuing I/O, and triggering cancellation. No victim action or interaction is required.\nS:U - The corruption is confined to kernel heap objects (`io_kiocb`) within the same security authority; the ublk driver and io_uring both run in the kernel's own scope. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed io_uring request is dereferenced and re-completed, so an attacker who reclaims the slab object controls its contents and can have kernel data posted back through the CQE and the ublk io path. Per UAF guidance this constitutes a path to arbitrary kernel memory disclosure.\nI:H - The second `io_uring_cmd_done()` writes result fields into and relinks a freed `io_kiocb`, and the request is freed twice — a write-after-free plus double-free on a well-known io_uring slab that is a standard heap-spray target for control-flow hijack. This is high-integrity memory corruption, not a bounded write.\nA:H - The commit states plainly that \"kernel crash can be triggered,\" and the double completion corrupts io_uring's completion/task-work lists. Any unprivileged local user with a ublk device can panic the machine on demand."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/block/ublk_drv.c"
                    ],
                    "versions": [
                        {
                            "version": "216c8f5ef0f209a3797292c487bdaa6991ab4b92",
                            "lessThan": "fb2eb9ddf556f93fef45201e1f9d2b8674bcc975",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "216c8f5ef0f209a3797292c487bdaa6991ab4b92",
                            "lessThan": "f40139fde5278d81af3227444fd6e76a76b9506d",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/block/ublk_drv.c"
                    ],
                    "versions": [
                        {
                            "version": "6.7",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.7",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.14.6",
                            "lessThanOrEqual": "6.14.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.7",
                                    "versionEndExcluding": "6.14.6"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.7",
                                    "versionEndExcluding": "6.15"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/fb2eb9ddf556f93fef45201e1f9d2b8674bcc975"
                },
                {
                    "url": "https://git.kernel.org/stable/c/f40139fde5278d81af3227444fd6e76a76b9506d"
                }
            ],
            "title": "ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}