CVE-2025-38182

What it actually does

The vulnerability allows unsanitized queue depth and number of queues values supplied from userspace to be accepted when adding a ublk device, bypassing input validation checks in the Linux kernel block layer.

Why it matters to the business

Systems depending on azle may experience instability or unexpected behavior during block device setup, increasing operational risk for environments using affected versions; the issue has low exploitation likelihood and no known ransomware use but requires prompt patching due to its age.

How an attack unfolds

An attacker interacts with the ublk userspace interface to register a new device while supplying crafted or out-of-range values for queue depth and queue count that are not validated before use in kernel structures.

How to fix it

Upgrade azle (npm) to version 0.30.0 or later; for demergent-labs/azle (GIT) apply commit b1a14d97318aeae762f385877043bda065ce143c or newer. Verify the update resolves the missing sanity checks before re-enabling ublk functionality.

How to confirm the fix worked

Confirm the installed azle package version meets or exceeds the fixed releases, then test device addition with boundary values for queue depth and queue count to ensure rejections occur as expected.

Typical attack path

1. Identify a system exposing the ublk device addition interface
2. Craft a userspace request containing invalid queue depth or number of queues
3. Submit the request to trigger acceptance of unsanitized parameters
4. Observe or leverage resulting kernel state corruption or denial of service

How to detect it

Review kernel logs for ublk device registration events that lack proper validation errors; correlate with process activity invoking the ublk interface and look for unusual queue configuration attempts in audit trails.

What your security team should do

• Prioritize upgrade of all azle deployments to the specified fixed versions within the next maintenance window
• Audit any custom ublk device registration code for additional input validation needs
• Monitor EPSS trend and kernel mailing list for related follow-on issues