In the Linux kernel, the following vulnerability has been resolved:
ublk: fix race between iouringcmdcompleteintask and ublkcancel_cmd
ublkcancelcmd() calls iouringcmddone() to complete uringcmd, but we may have scheduled task work via iouringcmdcompletein_task() for dispatching request, then kernel crash can be triggered.
Fix it by not trying to canceling the command if ublk block request is started.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f40139fde5278d81af3227444fd6e76a76b9506d",
"digest": {
"length": 173.0,
"function_hash": "271752798979098057110832853081929286795"
},
"id": "CVE-2025-37906-5b968ee2",
"deprecated": false,
"target": {
"file": "drivers/block/ublk_drv.c",
"function": "ublk_cancel_queue"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f40139fde5278d81af3227444fd6e76a76b9506d",
"digest": {
"length": 412.0,
"function_hash": "202566693720753283311417873753614733485"
},
"id": "CVE-2025-37906-81a20db2",
"deprecated": false,
"target": {
"file": "drivers/block/ublk_drv.c",
"function": "ublk_cancel_cmd"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f40139fde5278d81af3227444fd6e76a76b9506d",
"digest": {
"line_hashes": [
"238074979561376754509184114713083253622",
"299430584920422110871009415457336572675",
"262013171335013838330392074901479290838",
"223640362437637073029921966495694844586",
"170591014063213562312682750150841354434",
"97874949143677751815404237452311889489",
"249570616844075144838083130783794126951",
"170597658805214252056589854763202648090",
"38272870081062737621039552498699990185",
"304065550424304292450995893808394194322",
"81424488014543167777853098434908359716",
"184539574355789190611655476802344186393",
"239627173164802805399638993806166428777",
"134788671443159717440326717804970783055",
"14994168104475584140053230074261866559",
"225182825162415865968295348532372229987",
"301282047082979069411600825196669395665",
"108872536646881757067153508196962705446",
"150355944771350339451451060055854722227",
"229496398094716794368239511550428398158",
"98530296325927787106517165853203383363",
"203599470134293337851489459918123587727",
"187180887370893976772047819448673203391"
],
"threshold": 0.9
},
"id": "CVE-2025-37906-9db320de",
"deprecated": false,
"target": {
"file": "drivers/block/ublk_drv.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f40139fde5278d81af3227444fd6e76a76b9506d",
"digest": {
"length": 488.0,
"function_hash": "99420117483499459982800634720064684969"
},
"id": "CVE-2025-37906-bb3d15db",
"deprecated": false,
"target": {
"file": "drivers/block/ublk_drv.c",
"function": "ublk_uring_cmd_cancel_fn"
},
"signature_type": "Function",
"signature_version": "v1"
}
]