CVE-2025-37906

A flaw was found in the Linux kernel's ublk subsystem. This vulnerability allows a kernel crash via a race condition between io_uring_cmd_complete_in_task and ublk_cancel_cmd.

A moderate-severity race condition was found in the Linux kernel's ublk subsystem, which implements userspace block devices on top of io_uring. When a ublk command is canceled via ublk_cancel_cmd(), which calls io_uring_cmd_done() to complete the uring command, while task work for dispatching the block request has already been scheduled through io_uring_cmd_complete_in_task(), the race can trigger a kernel crash. A local user able to run a ublk userspace driver could use this flaw to cause a denial of service (kernel crash). Red Hat rates this flaw as Moderate severity (CVSS 3.1: 4.1, AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with high privileges and high attack complexity, and the impact is limited to system availability. This differs from the upstream CVEORG score of 7.8, which assumes low attack complexity, low privileges, and confidentiality and integrity impacts that Red Hat's assessment does not support. In Red Hat's product scope, only the Red Hat Enterprise Linux 10 kernel is affected, and the fix is currently deferred to a future update; the residual risk is a local denial of service that requires an actor with high privileges able to drive a ublk device. Red Hat Enterprise Linux 6, 7, 8, and 9, Red Hat In-Vehicle OS, and Hosted OpenShift Clusters are marked not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.