CVE-2025-71070

Vulnerability

In the Linux kernel's ublk (userspace block) driver, a reference count management flaw exists when a ublk server process releases a ublk char device file. If requests dispatched to the server have not yet completed at the time of exit, they retain a reference count of UBLK_REFCOUNT_INIT. A prior optimization in commit e63d2228ef83 changed __ublk_fail_req() to call __ublk_complete_rq() directly without first decrementing the request's reference count, leading to a leak. The incomplete fix in commit c5c5eb24ed61 [1] addressed only zero-copy and auto-buffer-registration modes, but the leak also affects the UBLK_F_USER_COPY mode, another reference-counted data copy mechanism.

Exploitation

An attacker with local access able to trigger a ublk server exit while requests are in-flight can exploit this flaw. The leaked reference count incorrectly allows user copy and zero copy operations on completed requests. Additionally, the condition triggers WARN_ON_ONCE(refcount_read(&io->ref)) warnings in ublk_queue_reinit() and ublk_deinit_queue() [2]. No authentication beyond the ability to interact with the ublk device is required.

Impact

An attacker could potentially manipulate completed request data via user copy or zero copy operations, leading to memory corruption or information disclosure. The warnings indicate a kernel state inconsistency that may enable further exploitation.

Mitigation

The fix corrects the condition in ublk_check_and_reset_active_ref() to include all reference-counted data copy modes, ensuring that any ublk requests still owned by the server when it exits have their reference counts reset to 0. The patch has been applied to the stable kernel tree [1][2]. Users should update to the latest patched kernel version.