Linux Kernel Vulnerability: User-Space Argument Sanitization in ublk Package
Summary
CVE-2025-38182: In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace whe... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, including Debian. It manages system resources and hardware interactions, providing essential services for software applications. The ublk subsystem allows block devices to be created and managed in user space. This vulnerability pertains to the lack of proper validation of user-supplied arguments when adding a device, potentially leading to system instability or security breaches.
Vulnerability Detail
In the Linux kernel, specifically within the ublk subsystem, a vulnerability has been identified where user-supplied arguments for queue depth and number of queues are not adequately sanitized. This oversight can allow malicious users to manipulate these parameters, potentially leading to denial of service or other unintended behaviors. The vulnerability was introduced in version 0 and affects both Debian 12 and Debian 13 distributions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any risks.
Conclusion
The CVE-2025-38182 vulnerability in the Linux kernel's ublk subsystem poses significant risks due to improper sanitization of user inputs. Users are strongly encouraged to update their systems to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38182 is a vulnerability in the Linux kernel's ublk subsystem that involves improper sanitization of user-supplied arguments when adding a device.
This vulnerability can lead to system instability, denial of service, or potential security breaches if exploited by malicious users.
Yes, both Debian 12 and Debian 13 systems are affected by this vulnerability. It is crucial to update your kernel to the latest version.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the update as soon as it is feasible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
