{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-71070","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-01-13T15:30:19.647Z","datePublished":"2026-01-13T15:31:24.709Z","dateUpdated":"2026-08-05T12:11:51.227Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:11:51.227Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: clean up user copy references on ublk server exit\n\nIf a ublk server process releases a ublk char device file, any requests\ndispatched to the ublk server but not yet completed will retain a ref\nvalue of UBLK_REFCOUNT_INIT. Before commit e63d2228ef83 (\"ublk: simplify\naborting ublk request\"), __ublk_fail_req() would decrement the reference\ncount before completing the failed request. However, that commit\noptimized __ublk_fail_req() to call __ublk_complete_rq() directly\nwithout decrementing the request reference count.\nThe leaked reference count incorrectly allows user copy and zero copy\noperations on the completed ublk request. It also triggers the\nWARN_ON_ONCE(refcount_read(&io->ref)) warnings in ublk_queue_reinit()\nand ublk_deinit_queue().\nCommit c5c5eb24ed61 (\"ublk: avoid ublk_io_release() called after ublk\nchar dev is closed\") already fixed the issue for ublk devices using\nUBLK_F_SUPPORT_ZERO_COPY or UBLK_F_AUTO_BUF_REG. However, the reference\ncount leak also affects UBLK_F_USER_COPY, the other reference-counted\ndata copy mode. Fix the condition in ublk_check_and_reset_active_ref()\nto include all reference-counted data copy modes. This ensures that any\nublk requests still owned by the ublk server when it exits have their\nreference counts reset to 0."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation uses local close, io_uring, and pread/pwrite operations on a ublk character device; no network or physical path reaches the flaw.\nAC:L - A malicious server can control the outstanding I/O, server exit, request generation, and concurrent copy/commit operations. It can park the dispatch task or stall user copying, so the relevant race does not depend on uncontrollable conditions.\nPR:L - The data-plane open/read/write path has no capability check and explicitly supports non-CAP_SYS_ADMIN daemon tasks when device-node access is delegated. Device provisioning and recovery require initial-namespace CAP_SYS_ADMIN, but a low-privileged daemon account can exploit an already managed USER_COPY device.\nUI:N - The attacker can generate the necessary block I/O and server shutdown/recovery sequence without another user's action.\nS:U - The vulnerable ublk code and the affected kernel memory and execution context belong to the same kernel security authority.\nC:H - The stale reference can permit a copy before dispatch resets the refcount, after which concurrent completion can free or reuse bio, bvec, and request pages still being traversed. A pread operation can therefore disclose broadly controllable freed or reallocated kernel-backed memory.\nI:H - A concurrent pwrite can operate through freed or attacker-groomed bio/bvec state, providing a path to corrupt reused pages or redirect writes to kernel memory and potentially hijack control flow.\nA:H - The resulting use-after-free can cause an oops or kernel panic, and the deterministic WARN_ON_ONCE sites can also panic systems configured with panic-on-warn."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/ublk_drv.c"],"versions":[{"version":"e63d2228ef831af36f963b3ab8604160cfff84c1","lessThan":"13456b4f1033d911f8bf3a0a1195656f293ba0f6","status":"affected","versionType":"git"},{"version":"e63d2228ef831af36f963b3ab8604160cfff84c1","lessThan":"daa24603d9f0808929514ee62ced30052ca7221c","status":"affected","versionType":"git"},{"version":"e537193fc4a43b48ac51cc6366319e15e32dd540","status":"affected","versionType":"git"},{"version":"6.14.6","lessThan":"6.15","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/ublk_drv.c"],"versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","status":"unaffected","versionType":"semver"},{"version":"6.18.3","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14.6"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/13456b4f1033d911f8bf3a0a1195656f293ba0f6"},{"url":"https://git.kernel.org/stable/c/daa24603d9f0808929514ee62ced30052ca7221c"}],"title":"ublk: clean up user copy references on ublk server exit","x_generator":{"engine":"bippy-1.2.0"}}}}