CVE-2025-22068 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_uring_cmd_complete_in_task(). Once ubq->canceling is set, the uring_cmd can be done via ublk_cancel_cmd() and io_uring_cmd_done(). So set ubq->canceling when queue is frozen, this way makes sure that the flag can be observed from ublk_queue_rq() reliably, and avoids use-after-free on uring_cmd.
A vulnerability in the Linux kernel's ublk driver has been addressed, related to how the driver manages request queues. The issue arose because the driver relied on the 'ubq->canceling' flag to determine whether requests could be processed. If the queue was frozen, this flag needed to be set to prevent a use-after-free error when handling commands via the io_uring interface. The vulnerability has been resolved by ensuring that 'ubq->canceling' is properly set when the queue is frozen, allowing for safe command cancellation and completion.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/5491400589e7572c2d2627ed6384302f7672aa1d | kernel.org | Patch |
| https://git.kernel.org/stable/c/7e3497d7dacb5aee69dd9be842b778083cae0e75 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8741d0737921ec1c03cf59aebf4d01400c2b461a | kernel.org | Patch |
| https://git.kernel.org/stable/c/9158359015f0eda00e521e35b7bc7ebce176aebf | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-416 | Use After Free | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.7, < 6.12.23 >= 6.13, < 6.13.11 >= 6.14, < 6.14.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | CVE Modified | CISA-ADP |
| May 6, 2025 | Initial Analysis | [email protected] |
| Apr 16, 2025 | New CVE Received | kernel.org |