Look up another CVE · open CVE-2025-37906 in the interactive tracker
CVE-2025-37906
ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
Published 2025-05-20 (17 months ago) by the Linux kernel CNA. Subsystem drivers/block. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2025-37906 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may have scheduled task work via io_uring_cmd_complete_in_task() for dispatching request, then kernel crash can be triggered. Fix it by not trying to canceling the command if ublk block request is started.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/block/ublk_drv.c
- What this is
- UBLK USERSPACE BLOCK DRIVERMAINTAINERS section matched on drivers/block/ublk_drv.c · linux-block@vger.kernel.org · Maintained
- Kernel module
- ublk_drv
Check it on the machine
grep -w CONFIG_BLK_DEV_UBLK /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ublk_drvPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 1 release. It does build it in 3 releases, so the answer depends on which release the machine runs.
- bookwormn
- trixie, forky, sidm
- n
- not enabled on any flavour - this release does not build the code
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_BLK_DEV_UBLK
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-05-20 (17 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/block
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.7 | 6.14.6 | fb2eb9ddf556 |
| 6.7 | 6.15 | f40139fde527 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The race is reached only through local interfaces — `/dev/ublk-control` and `/dev/ublkc*` io_uring passthrough commands plus block I/O to `/dev/ublkb*`. There is no remote or adjacent-network path into ublk_drv.
- AC:LAttack complexity, low
- The attacker owns both sides of the race: one thread submits I/O to the ublk block device (queueing `ublk_cmd_tw_cb` task work) while another tears down the io_uring ring or issues `UBLK_CMD_STOP_DEV`, driving `ublk_cancel_cmd()`. The window can be hit repeatedly in a loop with high queue depth until it lands.
- PR:LPrivileges required, low
- ublk explicitly supports `UBLK_F_UNPRIVILEGED_DEV`, where `ublk_ctrl_add_dev()` accepts non-`CAP_SYS_ADMIN` callers and all later control commands gate only on file permissions of `/dev/ublkc*`, so an ordinary local user (including inside a container) can create and drive the device. Only basic local-user access is needed, not real root.
- UI:NUser interaction, none
- The attacking process performs every step itself — creating the ublk device, issuing I/O, and triggering cancellation. No victim action or interaction is required.
- S:UScope, unchanged
- The corruption is confined to kernel heap objects (`io_kiocb`) within the same security authority; the ublk driver and io_uring both run in the kernel's own scope. No VM, IOMMU, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- The freed io_uring request is dereferenced and re-completed, so an attacker who reclaims the slab object controls its contents and can have kernel data posted back through the CQE and the ublk io path. Per UAF guidance this constitutes a path to arbitrary kernel memory disclosure.
- I:HIntegrity impact, high
- The second `io_uring_cmd_done()` writes result fields into and relinks a freed `io_kiocb`, and the request is freed twice — a write-after-free plus double-free on a well-known io_uring slab that is a standard heap-spray target for control-flow hijack. This is high-integrity memory corruption, not a bounded write.
- A:HAvailability impact, high
- The commit states plainly that "kernel crash can be triggered," and the double completion corrupts io_uring's completion/task-work lists. Any unprivileged local user with a ublk device can panic the machine on demand.