What’s Vulnerable › Vulnerabilities

CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-04 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace when adding a device.

Affected products

• Linux kernel: from 6.0 before 6.6.95; from 6.7 before 6.12.35; from 6.13 before 6.15.4; 6.16-rc1, 6.16-rc2 — fixed in 6.6.95, 6.12.35, 6.15.4
• Linux: 6.0 — fixed in 6.16

How to fix

Upgrade to a fixed version: Linux kernel 6.6.95, 6.12.35, 6.15.4; Linux 6.16. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0f8df5d6f25ac17c52a8bc6418e60a3e63130550
• https://git.kernel.org/stable/c/3162d8235c8c4d585525cee8a59d1c180940a968
• https://git.kernel.org/stable/c/8c8472855884355caf3d8e0c50adf825f83454b2
• https://git.kernel.org/stable/c/a52d4e28f643eb4ffc7ccb1de9bd47d876804f1f
• https://git.kernel.org/stable/c/e2b2b7cf6368580114851cb3932f2ad9fbf23386

Get alerted when CVE-2025-38182 or the next vulnerability affects your stack