CVE-2025-22068

HIGH EPSS 6.6%
Published Apr 16, 20251y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Apr 16, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_uring_cmd_complete_in_task(). Once ubq->canceling is set, the uring_cmd can be done via ublk_cancel_cmd() and io_uring_cmd_done(). So set ubq->canceling when queue is frozen, this way makes sure that the flag can be observed from ublk_queue_rq() reliably, and avoids use-after-free on uring_cmd.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
6.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 3

VendorProductVersionRange
linuxlinux_kernel*≥6.7  –  <6.12.23
linuxlinux_kernel*≥6.13  –  <6.13.11
linuxlinux_kernel*≥6.14  –  <6.14.2

References 4

  • git.kernel.org https://git.kernel.org/stable/c/5491400589e7572c2d2627ed6384302f7672aa1d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7e3497d7dacb5aee69dd9be842b778083cae0e75
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8741d0737921ec1c03cf59aebf4d01400c2b461a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9158359015f0eda00e521e35b7bc7ebce176aebf
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/5491400589e7572c2d2627ed6384302f7672aa1d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7e3497d7dacb5aee69dd9be842b778083cae0e75
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8741d0737921ec1c03cf59aebf4d01400c2b461a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9158359015f0eda00e521e35b7bc7ebce176aebf
    Patch