CVE-2025-22068

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-22068
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-22068.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-22068
Downstream
Related
Published
2025-04-16T14:12:21Z
Modified
2025-10-17T23:29:46.929557Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ublk: make sure ubq->canceling is set when queue is frozen
Details

In the Linux kernel, the following vulnerability has been resolved:

ublk: make sure ubq->canceling is set when queue is frozen

Now ublk driver depends on ubq->canceling for deciding if the request can be dispatched via uringcmd & iouringcmdcompleteintask().

Once ubq->canceling is set, the uringcmd can be done via ublkcancelcmd() and iouringcmddone().

So set ubq->canceling when queue is frozen, this way makes sure that the flag can be observed from ublkqueuerq() reliably, and avoids use-after-free on uring_cmd.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
216c8f5ef0f209a3797292c487bdaa6991ab4b92
Fixed
7e3497d7dacb5aee69dd9be842b778083cae0e75
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
216c8f5ef0f209a3797292c487bdaa6991ab4b92
Fixed
5491400589e7572c2d2627ed6384302f7672aa1d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
216c8f5ef0f209a3797292c487bdaa6991ab4b92
Fixed
9158359015f0eda00e521e35b7bc7ebce176aebf
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
216c8f5ef0f209a3797292c487bdaa6991ab4b92
Fixed
8741d0737921ec1c03cf59aebf4d01400c2b461a

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.10
v6.13.2
v6.13.3
v6.13.4
v6.13.5
v6.13.6
v6.13.7
v6.13.8
v6.13.9
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.14.1
v6.6
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "id": "CVE-2025-22068-185b891e",
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/ublk_drv.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9158359015f0eda00e521e35b7bc7ebce176aebf",
        "digest": {
            "line_hashes": [
                "148833420272202014808725030688952857724",
                "251241250143137343042188146050716582743",
                "270430310117770758030293451740748246204",
                "156444112875008025507761331674437334621",
                "258137002179016891946213794393435196265",
                "184709906824713409860288612446045043627",
                "214543157763786235035437049194144197113",
                "36640704262491337188359061943768029583",
                "32764786746589853887546117726536117682",
                "140924022894656196706095413363881985858",
                "273446622911355460125440743980478689463",
                "50406554137131966145825179313224078162",
                "139478852614188970605640652383563983899",
                "119320972727433374228333052252444181667",
                "73742928498066326878608634775868757645",
                "150643180192488076712308202571472998484",
                "169815372408986139664749570784704138012",
                "61658679019570228317650594783019537257",
                "183036546136863207099218215739614392915",
                "191449844412627105865325140473424910965",
                "313913579327960153680742605484825902979"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-22068-23c234ee",
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/ublk_drv.c",
            "function": "ublk_abort_requests"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8741d0737921ec1c03cf59aebf4d01400c2b461a",
        "digest": {
            "length": 549.0,
            "function_hash": "268986041812153796484829336364776107948"
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-22068-66cea86b",
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/ublk_drv.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e3497d7dacb5aee69dd9be842b778083cae0e75",
        "digest": {
            "line_hashes": [
                "148833420272202014808725030688952857724",
                "251241250143137343042188146050716582743",
                "270430310117770758030293451740748246204",
                "156444112875008025507761331674437334621",
                "258137002179016891946213794393435196265",
                "184709906824713409860288612446045043627",
                "214543157763786235035437049194144197113",
                "36640704262491337188359061943768029583",
                "32764786746589853887546117726536117682",
                "140924022894656196706095413363881985858",
                "273446622911355460125440743980478689463",
                "50406554137131966145825179313224078162",
                "139478852614188970605640652383563983899",
                "119320972727433374228333052252444181667",
                "73742928498066326878608634775868757645",
                "150643180192488076712308202571472998484",
                "169815372408986139664749570784704138012",
                "61658679019570228317650594783019537257",
                "183036546136863207099218215739614392915",
                "191449844412627105865325140473424910965",
                "313913579327960153680742605484825902979"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-22068-90146ec7",
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/ublk_drv.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8741d0737921ec1c03cf59aebf4d01400c2b461a",
        "digest": {
            "line_hashes": [
                "148833420272202014808725030688952857724",
                "251241250143137343042188146050716582743",
                "270430310117770758030293451740748246204",
                "156444112875008025507761331674437334621",
                "258137002179016891946213794393435196265",
                "184709906824713409860288612446045043627",
                "214543157763786235035437049194144197113",
                "36640704262491337188359061943768029583",
                "32764786746589853887546117726536117682",
                "140924022894656196706095413363881985858",
                "273446622911355460125440743980478689463",
                "50406554137131966145825179313224078162",
                "139478852614188970605640652383563983899",
                "119320972727433374228333052252444181667",
                "73742928498066326878608634775868757645",
                "150643180192488076712308202571472998484",
                "169815372408986139664749570784704138012",
                "61658679019570228317650594783019537257",
                "183036546136863207099218215739614392915",
                "191449844412627105865325140473424910965",
                "313913579327960153680742605484825902979"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-22068-987d6209",
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/ublk_drv.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5491400589e7572c2d2627ed6384302f7672aa1d",
        "digest": {
            "line_hashes": [
                "148833420272202014808725030688952857724",
                "251241250143137343042188146050716582743",
                "270430310117770758030293451740748246204",
                "156444112875008025507761331674437334621",
                "258137002179016891946213794393435196265",
                "184709906824713409860288612446045043627",
                "214543157763786235035437049194144197113",
                "36640704262491337188359061943768029583",
                "32764786746589853887546117726536117682",
                "140924022894656196706095413363881985858",
                "273446622911355460125440743980478689463",
                "50406554137131966145825179313224078162",
                "139478852614188970605640652383563983899",
                "119320972727433374228333052252444181667",
                "73742928498066326878608634775868757645",
                "150643180192488076712308202571472998484",
                "169815372408986139664749570784704138012",
                "61658679019570228317650594783019537257",
                "183036546136863207099218215739614392915",
                "191449844412627105865325140473424910965",
                "313913579327960153680742605484825902979"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-22068-9b4d5ecb",
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/ublk_drv.c",
            "function": "ublk_abort_requests"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5491400589e7572c2d2627ed6384302f7672aa1d",
        "digest": {
            "length": 549.0,
            "function_hash": "268986041812153796484829336364776107948"
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-22068-9c70bf2c",
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/ublk_drv.c",
            "function": "ublk_abort_requests"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9158359015f0eda00e521e35b7bc7ebce176aebf",
        "digest": {
            "length": 549.0,
            "function_hash": "268986041812153796484829336364776107948"
        },
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-22068-ee44787e",
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/ublk_drv.c",
            "function": "ublk_abort_requests"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e3497d7dacb5aee69dd9be842b778083cae0e75",
        "digest": {
            "length": 549.0,
            "function_hash": "268986041812153796484829336364776107948"
        },
        "signature_version": "v1"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.23
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.11
Type
ECOSYSTEM
Events
Introduced
6.14.0
Fixed
6.14.2