High severity7.8NVD Advisory· Published May 20, 2025· Updated Jul 30, 2026

CVE-2025-37906

Description

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may have scheduled task work via io_uring_cmd_complete_in_task() for dispatching request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is started.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Linux/Kernelllm-fuzzy6 versions
(expand)+ 5 more
- (no CPE)
- (no CPE)range: 6.7
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.7,<6.14.6
- cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
osv-coords6 versions
pkg:linux/kernel pkg:apk/chainguard/linux-aws-6.12 pkg:apk/chainguard/linux-azure-6.12 pkg:apk/chainguard/linux-gcp-6.12 pkg:apk/chainguard/linux-qemu-6.12 pkg:apk/chainguard/linux-vmware-6.12
>= 6.7.0, < 6.14.6+ 5 more
- (no CPE)range: >= 6.7.0, < 6.14.6
- (no CPE)range: < 6.12.80-r0
- (no CPE)range: < 6.12.80-r0
- (no CPE)range: < 6.12.80-r0
- (no CPE)range: < 6.12.80-r0
- (no CPE)range: < 6.12.80-r0

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2025-37906

Description

AI Insight

Affected products

Patches

Vulnerability mechanics

References

News mentions