CVE-2025-22068: ublk: make sure ubq->canceling is set when queue is frozen
In the Linux kernel, the following vulnerability has been resolved:
ublk: make sure ubq->canceling is set when queue is frozen
Now ublk driver depends on ubq->canceling for deciding if the request can be dispatched via uringcmd & iouringcmdcompleteintask().
Once ubq->canceling is set, the uringcmd can be done via ublkcancelcmd() and iouringcmddone().
So set ubq->canceling when queue is frozen, this way makes sure that the flag can be observed from ublkqueuerq() reliably, and avoids use-after-free on uringcmd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set ubq->canceling when the queue is frozen so uring_cmd can be dispatched via ublk_cancel_cmd() and the flag can be observed from ublk_queue_rq() reliably, avoiding use-after-free on uring_cmd.
Linux kernel ublk driver ubq->canceling = true
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22068?
CVE-2025-22068 has been classified with a severity rating that indicates it poses important security risks related to the Linux kernel.
How do I fix CVE-2025-22068?
To mitigate CVE-2025-22068, ensure that you update your Linux kernel to the patched version where this vulnerability has been addressed.
What are the primary impacts of CVE-2025-22068?
CVE-2025-22068 affects the ublk driver functionality, potentially allowing incorrect request dispatching when unpacking queued requests.
Which versions of the Linux kernel are affected by CVE-2025-22068?
CVE-2025-22068 affects specific versions of the Linux kernel that do not have the latest security patches applied.
Is CVE-2025-22068 publicly known?
Yes, CVE-2025-22068 is a publicly disclosed vulnerability that is part of the official CVE database.