CVE-2025-38182

ublk: santizize the arguments from userspace when adding a device

HIGH

7.8

CVSS Score

Published: July 4, 2025 at 01:37 PM UTC

Updated: June 17, 2026 at 09:16 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace when adding a device.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

6.0 ≤ v < 6.12.356.0 ≤ v < 6.15.46.0 ≤ v < 6.166.0 ≤ v < 6.6.956.13 ≤ v < 6.15.46.7 ≤ v < 6.12.356.0 6.16 rc1 6.16 rc271f28f3136aff5890cd56de78abc673f8393cad9

Vendor states this is fixed in 0f8df5d6f25ac17c52a8bc6418e60a3e63130550 (fixed)

Vendor states this is fixed in 3162d8235c8c4d585525cee8a59d1c180940a968 (fixed)

Vendor states this is fixed in 8c8472855884355caf3d8e0c50adf825f83454b2 (fixed)

Vendor states this is fixed in e2b2b7cf6368580114851cb3932f2ad9fbf23386 (fixed)

Vendor states this is fixed in 6.0 (unaffected)

Vendor states this is fixed in 6.12.35 (unaffected)

Vendor states this is fixed in 6.15.4 (unaffected)

Vendor states this is fixed in 6.16 (unaffected)

Vendor states this is fixed in 6.6.95 (unaffected)