CVE-2025-22068

Description

In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_uring_cmd_complete_in_task(). Once ubq->canceling is set, the uring_cmd can be done via ublk_cancel_cmd() and io_uring_cmd_done(). So set ubq->canceling when queue is frozen, this way makes sure that the flag can be observed from ublk_queue_rq() reliably, and avoids use-after-free on uring_cmd.

CVSS Metrics

• v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.03%• Percentile: 9%

Techniques & Countermeasures

• CWE-416•Use After Free

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

• linux•linux

  ≥ 216c8f5ef0f209a3797292c487bdaa6991ab4b92, < 7e3497d7dacb5aee69dd9be842b778083cae0e75 | ≥ 216c8f5ef0f209a3797292c487bdaa6991ab4b92, < 5491400589e7572c2d2627ed6384302f7672aa1d | ≥ 216c8f5ef0f209a3797292c487bdaa6991ab4b92, < 9158359015f0eda00e521e35b7bc7ebce176aebf | ≥ 216c8f5ef0f209a3797292c487bdaa6991ab4b92, < 8741d0737921ec1c03cf59aebf4d01400c2b461a | 6.7

• linux•linux_kernel

  ≥ 6.7, < 6.12.23 | ≥ 6.13, < 6.13.11 | ≥ 6.14, < 6.14.2

References (4)

• https://git.kernel.org/stable/c/7e3497d7dacb5aee69dd9be842b778083cae0e75
• https://git.kernel.org/stable/c/5491400589e7572c2d2627ed6384302f7672aa1d
• https://git.kernel.org/stable/c/9158359015f0eda00e521e35b7bc7ebce176aebf
• https://git.kernel.org/stable/c/8741d0737921ec1c03cf59aebf4d01400c2b461a