Linux Kernel up to 6.18.2/6.19-rc2 __ublk_fail_req reference count

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.2/6.19-rc2. This impacts the function __ublk_fail_req. Performing a manipulation results in reference count. This vulnerability is known as CVE-2025-71070. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.2/6.19-rc2. This affects the function __ublk_fail_req. The manipulation with an unknown input leads to a reference count vulnerability. CWE is classifying the issue as CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. This is going to have an impact on availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk server process releases a ublk char device file, any requests dispatched to the ublk server but not yet completed will retain a ref value of UBLK_REFCOUNT_INIT. Before commit e63d2228ef83 ("ublk: simplify aborting ublk request"), __ublk_fail_req() would decrement the reference count before completing the failed request. However, that commit optimized __ublk_fail_req() to call __ublk_complete_rq() directly without decrementing the request reference count. The leaked reference count incorrectly allows user copy and zero copy operations on the completed ublk request. It also triggers the WARN_ON_ONCE(refcount_read(&io->ref)) warnings in ublk_queue_reinit() and ublk_deinit_queue(). Commit c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed") already fixed the issue for ublk devices using UBLK_F_SUPPORT_ZERO_COPY or UBLK_F_AUTO_BUF_REG. However, the reference count leak also affects UBLK_F_USER_COPY, the other reference-counted data copy mode. Fix the condition in ublk_check_and_reset_active_ref() to include all reference-counted data copy modes. This ensures that any ublk requests still owned by the ublk server when it exits have their reference counts reset to 0.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2025-71070 since 01/13/2026. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.18.3 or 6.19-rc3 eliminates this vulnerability. Applying the patch 13456b4f1033d911f8bf3a0a1195656f293ba0f6/daa24603d9f0808929514ee62ced30052ca7221c is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.19-rc1
• 6.19-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion