Security readout for executives and security teams
Plain-English summary
A flaw in Linux's ublk block-device driver can leave an asynchronous I/O command referencing freed memory when a queue is frozen. Successful triggering could crash the system or corrupt kernel memory, potentially affecting confidentiality, integrity, and availability. The supplied CVSS vector requires local, low-privileged access.
Executive priority
Treat this as a high-priority kernel update for multi-user, hosting, CI, or other systems using ublk. It is not supported as an internet-remote emergency by the supplied evidence, but potential kernel compromise warrants accelerated remediation where local untrusted users or workloads exist.
Technical view
ublk_queue_rq() relies on ubq->canceling to select safe uring_cmd completion behavior. During queue freezing, that flag was not reliably set, allowing an asynchronous command to outlive its associated object and cause a use-after-free. The cited stable commits set the flag when freezing the queue.
Likely exposure
Exposure is most plausible on affected Linux kernels where ublk is available and exercised during queue-freezing or cancellation conditions. The supplied version data is ambiguous, containing duplicated hashes and a "0" entry, so organizations should map their exact distribution kernel builds to vendor advisories or the cited fixes.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of public exploitation, a proof of concept, or observed attacks. CVSS 3.1 scores it 7.8 with local access, low privileges, low complexity, and no user interaction; these characteristics describe potential exploitability, not confirmed exploitation.
Researcher notes
This is CWE-416 involving asynchronous command lifetime during ublk queue freezing. The description identifies the missing canceling-state transition and the intended correction. Exact affected-release boundaries and distribution backports cannot be established confidently from the normalized version list alone. No exploitability demonstration is supplied.
Mitigation direction
- Apply a vendor-supported kernel update that incorporates one of the cited stable fixes.
- Consult the Linux distribution's advisory for exact fixed packages and any officially supported interim mitigation.
- Verify the updated kernel is actually running across affected hosts.
- Restrict untrusted local access to ublk-using systems until remediation is complete.
Validation and detection
- Inventory running kernel builds and identify systems where ublk is enabled or used.
- Check vendor changelogs or backport records for CVE-2025-22068 or the cited commit identifiers.
- Confirm the relevant fix is present in each deployed kernel source or package build.
- Review kernel faults for ublk or io_uring use-after-free symptoms; their absence does not establish safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22068 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7e3497d7dacb5aee69dd9be842b778083cae0e75CVE reference, Linux
- https://git.kernel.org/stable/c/5491400589e7572c2d2627ed6384302f7672aa1dCVE reference, Linux
- https://git.kernel.org/stable/c/9158359015f0eda00e521e35b7bc7ebce176aebfCVE reference, Linux
- https://git.kernel.org/stable/c/8741d0737921ec1c03cf59aebf4d01400c2b461aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.