[SRU][N][PATCH 0/1] CVE-2025-37906

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-37906

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may
have scheduled task work via io_uring_cmd_complete_in_task() for dispatching
request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is started.

[ Fix ]

noble/linux: backported from f40139fde527

The fix adds a check so that a uring_cmd is not canceled once its associated
ublk block request has been started, avoiding the race where the same command
is completed both by the cancel path and by the task work scheduled for
request dispatch.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would affect systems that use the ublk userspace block driver
(CONFIG_BLK_DEV_UBLK), such as hosts running userspace-defined block devices
for storage or virtualization; a regression could show up as hangs, stuck
I/O, or crashes during device recovery or teardown. Systems that do not load
the ublk module and do not create ublk devices are not affected.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: 1f1a5612/v1