CVE-2025-37906: ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
Modified
AliasesUBUNTU-CVE-2025-37906DEBIAN-CVE-2025-37906CGA-23mx-8p5r-gvpfCGA-2936-jc4q-88j3CGA-2r8m-8x29-qq97CGA-35fg-g2q7-58rjCGA-366q-78v8-rqp9CGA-3h72-82xv-wpp7CGA-3h7h-9f7v-q2g8CGA-3q6p-x7fc-79w8CGA-3qq2-99wj-8c33CGA-3qw7-p5mf-9mjxCGA-3r3p-x9gp-9g6mCGA-45cw-jh34-jcg6CGA-45gw-m86x-7v85CGA-47v2-f9pr-4hrvCGA-4jh5-h438-3fjvCGA-4mc6-33xf-27r4CGA-4prm-mg8p-gq2wCGA-4w3g-r2wx-8p5mCGA-4wgc-cc2m-jhrrCGA-4xxj-pp68-f8hwCGA-5hp4-j2v9-3qmxCGA-5mf2-27f2-3gcvCGA-5x24-jrpr-mjfcCGA-62hh-x64m-qrp5CGA-66px-3r6v-23gfCGA-696g-5hw2-r575CGA-6cgq-4557-39wrCGA-6fg5-3fvp-8f4vCGA-6frj-jwj3-m5vmCGA-6fxr-fhjg-v9vcCGA-6qfw-hc6j-4vj6CGA-74j5-x3q7-v9x3CGA-758w-2cpf-pmcpCGA-75rh-jp78-cwxcCGA-79p6-3c62-r8jwCGA-79qq-x2r6-9367CGA-7chp-5fqv-994vCGA-7m4q-cr49-78w8CGA-83m9-rg86-5jvvCGA-89jh-j7pf-2j52CGA-8fpj-hcrp-xqjmCGA-8h82-76cm-45r7CGA-8px6-mf3r-74c8CGA-8qf8-97rm-qh3vCGA-978v-3vhp-2fj5CGA-99j9-wvm9-gqw4CGA-9g99-wjp4-g7f7CGA-9jxq-3mwm-9v7jCGA-9m6v-fg6m-6885CGA-9wj5-c7h2-rg3hCGA-9wpw-vq98-pc6wCGA-c8wf-2r9p-w8xfCGA-c968-v756-wjrqCGA-ch2c-88hr-6whjCGA-cm86-hgph-834vCGA-cqcv-r7m6-wh7gCGA-cqrg-g2fg-h252CGA-cvr4-448f-xq9wCGA-cw99-p7xp-24h7CGA-f699-79fh-v3p8CGA-f77m-gf5q-6jvfCGA-f8hp-wwgf-pwc6CGA-fjm5-vvfx-vjm7CGA-g8cg-5jp2-48mpCGA-gc7j-4qvp-hgv8CGA-ggj3-j99h-qgg3CGA-ggrh-5fjv-x3rvCGA-gqfg-mhcf-g3fqCGA-h4cv-hp7w-6cjhCGA-h4xh-jfxm-5w8mCGA-h75w-234x-mcv5CGA-hqqf-9c68-w496CGA-hvmm-rrh7-f6pwCGA-hw5c-w9wv-p6h9CGA-hxw2-5938-gm28CGA-j9j5-7x5j-4gqfCGA-jch3-58qh-24j9CGA-jgw4-rmgx-485vCGA-jmrr-p33p-hjq9CGA-jv8v-x3pv-47w5CGA-m88g-87mj-29c4CGA-m92q-wp3r-r9rhCGA-m95q-wjm4-r7gpCGA-m97h-7wm4-9qv6CGA-mg2q-9q2c-74cxCGA-mhmr-mghv-vcwcCGA-pcvw-26jr-7x93CGA-pgh8-ccvx-fg65CGA-phxp-f42j-rfq3CGA-pphp-5949-w5vwCGA-pq2j-62vm-x7jgCGA-pww7-m3mg-6wp8CGA-q6f4-qw9c-hh3rCGA-q89q-29jh-3537CGA-qmfj-c47q-cxxcCGA-qpgq-57w3-533cCGA-qww9-wj53-p35vCGA-qwwq-4x23-95h8CGA-r86f-mwrv-pgg6CGA-rc8j-9x8v-4mgjCGA-rg62-vfwp-77qgCGA-rhmq-cfvq-999fCGA-v475-4hr7-jr2pCGA-w2vj-45r8-8hvgCGA-w683-4gmp-32r9CGA-w733-fxw2-5m7jCGA-w8jg-2q8f-9wj7CGA-wg96-4vrp-fm97CGA-wmj9-hpc6-5g89CGA-wv66-pc8m-222gCGA-wv7j-39pm-28mfCGA-ww3v-cm35-743hCGA-wwhv-6rcf-hq4xCGA-x2f3-jwh8-2hp8CGA-x4qq-8374-8w5pCGA-x9j9-7h2f-3x3cCGA-xm5w-x37r-97gcCGA-xqpr-gf7q-v5g2
Published 20-05-2025Last modified 21-10-2026
Vulnerability summary
CVE-2025-37906 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.2% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.8/10
010
High · v3.1 (CVE.org)EPSS score
0.19%
0%100%
Low · +0.05 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 8Timeline
- 20-05-2025PublishedVulnerability first disclosed.
- 21-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may have scheduled task work via io_uring_cmd_complete_in_task() for dispatching request, then kernel crash can be triggered. Fix it by not trying to canceling the command if ublk block request is started.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesSingle source
High 7.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 4.7–7.8
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
Increase +0.05 pp
From 0.13% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu120 products
- linuxAll versions (No fix recorded)
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard5 products
- linux-aws-6.12< 6.12.74-r1 | < 6.12.66-r0 | < 6.12.65-r1 | < 6.12.68-r0 | < 6.12.62-r2 | < 6.12.74-r0 | < 6.12.65-r0 | < 6.12.70-r0 | < 6.12.72-r0 | < 6.12.77-r0 | < 6.12.77-r2 | < 6.12.67-r0 | < 6.12.65-r2 | < 6.12.62-r0 | < 6.12.78-r0 | < 6.12.68-r1 | < 6.12.63-r0 | < 6.12.62-r1 | < 6.12.76-r0 | < 6.12.71-r0 | < 6.12.77-r1 | < 6.12.57-r2 | < 6.12.69-r0 | < 6.12.80-r0 | < 6.12.72-r1 | < 6.12.60-r4
- linux-azure-6.12< 6.12.66-r0 | < 6.12.77-r1 | < 6.12.65-r3 | < 6.12.71-r0 | < 6.12.62-r0 | < 6.12.69-r0 | < 6.12.74-r1 | < 6.12.77-r2 | < 6.12.76-r0 | < 6.12.63-r0 | < 6.12.62-r1 | < 6.12.68-r0 | < 6.12.60-r4 | < 6.12.57-r2 | < 6.12.77-r0 | < 6.12.70-r0 | < 6.12.74-r0 | < 6.12.65-r1 | < 6.12.80-r0 | < 6.12.65-r2 | < 6.12.65-r4 | < 6.12.67-r0 | < 6.12.60-r3 | < 6.12.62-r2 | < 6.12.72-r0 | < 6.12.78-r0
- linux-gcp-6.12< 6.12.57-r2 | < 6.12.62-r1 | < 6.12.62-r2 | < 6.12.60-r4 | < 6.12.74-r1 | < 6.12.74-r0 | < 6.12.65-r2 | < 6.12.68-r1 | < 6.12.67-r0 | < 6.12.76-r0 | < 6.12.66-r0 | < 6.12.62-r0 | < 6.12.77-r0 | < 6.12.68-r0 | < 6.12.71-r0 | < 6.12.65-r1 | < 6.12.78-r0 | < 6.12.77-r2 | < 6.12.70-r0 | < 6.12.72-r0 | < 6.12.65-r0 | < 6.12.63-r0 | < 6.12.69-r0 | < 6.12.60-r3 | < 6.12.80-r0 | < 6.12.77-r1
- linux-qemu-6.12< 6.12.77-r0 | < 6.12.66-r0 | < 6.12.77-r1 | < 6.12.65-r2 | < 6.12.78-r0 | < 6.12.65-r1 | < 6.12.74-r0 | < 6.12.68-r0 | < 6.12.77-r2 | < 6.12.69-r0 | < 6.12.70-r0 | < 6.12.80-r0 | < 6.12.71-r0 | < 6.12.74-r1 | < 6.12.72-r0 | < 6.12.67-r0 | < 6.12.76-r0
- linux-vmware-6.12< 6.12.68-r0 | < 6.12.70-r0 | < 6.12.78-r0 | < 6.12.76-r0 | < 6.12.69-r0 | < 6.12.74-r0 | < 6.12.65-r1 | < 6.12.80-r0 | < 6.12.68-r1 | < 6.12.66-r0 | < 6.12.72-r0 | < 6.12.77-r0 | < 6.12.77-r1 | < 6.12.65-r2 | < 6.12.71-r0 | < 6.12.77-r2 | < 6.12.67-r0 | < 6.12.74-r1
Linux2 products
- linux≥ 216c8f5ef0f209a3797292c487bdaa6991ab4b92, < 346b7d74c612234dae0878892682b9722e7c04c8 | ≥ 216c8f5ef0f209a3797292c487bdaa6991ab4b92, < fb2eb9ddf556f93fef45201e1f9d2b8674bcc975 | ≥ 216c8f5ef0f209a3797292c487bdaa6991ab4b92, < f40139fde5278d81af3227444fd6e76a76b9506d | 6.7
- linux_kernel≥ 6.7, < 6.14.6 | 6.15:rc1 | 6.15:rc2 | 6.15:rc3
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.115-2 | < 6.16.3-1
4 vendors · 128 products
