Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk server process… (CVE-2025-71070)
In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk server process releases a ublk char device file, any requests dispatched to the ublk server but not yet completed will retain a ref value of UBLK_REFCOUNT_INIT. Before commit e63d2228ef83 ("ublk: simplify aborting ublk request"), __ublk_fail_req() would decrement the reference count before completing the failed request. However, that commit optimized __ublk_fail_req() to call __ublk_complete_rq() directly without decrementing the request reference count. The leaked reference count incorrectly allows user copy and zero copy operations on the completed ublk request. It also triggers the WARN_ON_ONCE(refcount_read(&io->ref)) warnings in ublk_queue_reinit() and ublk_deinit_queue(). Commit c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed") already fixed the issue for ublk devices using UBLK_F_SUPPORT_ZERO_COPY or UBLK_F_AUTO_BUF_REG. However, the reference count leak also affects UBLK_F_USER_COPY, the other reference-counted data copy mode. Fix the condition in ublk_check_and_reset_active_ref() to include all reference-counted data copy modes. This ensures that any ublk requests still owned by the ublk server when it exits have their reference counts reset to 0.
AI Analysis
Technical Summary
The Linux kernel ublk subsystem had a flaw where releasing a ublk char device file did not properly decrement reference counts on outstanding requests, specifically affecting the UBLK_F_USER_COPY data copy mode. This caused leaked reference counts that allowed operations on completed requests and triggered kernel warnings. The vulnerability was addressed by modifying ublk_check_and_reset_active_ref() to reset reference counts for all reference-counted data copy modes upon server exit, preventing the reference count leak.
Potential Impact
Leaked reference counts in the ublk server can lead to user copy and zero copy operations on completed requests, potentially causing memory corruption or use-after-free conditions. The CVSS vector indicates local attack complexity with low privileges required, and high impact on confidentiality, integrity, and availability. Kernel warnings may also be triggered, indicating instability.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly reset reference counts for all reference-counted ublk data copy modes when the ublk server exits. Users should apply the official kernel updates that include this fix. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or kernel mailing list advisories for the exact fixed versions and update accordingly.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk server process… (CVE-2025-71070)
Description
In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk server process releases a ublk char device file, any requests dispatched to the ublk server but not yet completed will retain a ref value of UBLK_REFCOUNT_INIT. Before commit e63d2228ef83 ("ublk: simplify aborting ublk request"), __ublk_fail_req() would decrement the reference count before completing the failed request. However, that commit optimized __ublk_fail_req() to call __ublk_complete_rq() directly without decrementing the request reference count. The leaked reference count incorrectly allows user copy and zero copy operations on the completed ublk request. It also triggers the WARN_ON_ONCE(refcount_read(&io->ref)) warnings in ublk_queue_reinit() and ublk_deinit_queue(). Commit c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed") already fixed the issue for ublk devices using UBLK_F_SUPPORT_ZERO_COPY or UBLK_F_AUTO_BUF_REG. However, the reference count leak also affects UBLK_F_USER_COPY, the other reference-counted data copy mode. Fix the condition in ublk_check_and_reset_active_ref() to include all reference-counted data copy modes. This ensures that any ublk requests still owned by the ublk server when it exits have their reference counts reset to 0.
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel ublk subsystem had a flaw where releasing a ublk char device file did not properly decrement reference counts on outstanding requests, specifically affecting the UBLK_F_USER_COPY data copy mode. This caused leaked reference counts that allowed operations on completed requests and triggered kernel warnings. The vulnerability was addressed by modifying ublk_check_and_reset_active_ref() to reset reference counts for all reference-counted data copy modes upon server exit, preventing the reference count leak.
Potential Impact
Leaked reference counts in the ublk server can lead to user copy and zero copy operations on completed requests, potentially causing memory corruption or use-after-free conditions. The CVSS vector indicates local attack complexity with low privileges required, and high impact on confidentiality, integrity, and availability. Kernel warnings may also be triggered, indicating instability.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly reset reference counts for all reference-counted ublk data copy modes when the ublk server exits. Users should apply the official kernel updates that include this fix. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or kernel mailing list advisories for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p797-qv57-j9x8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-71070"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d19c2644c7f847705c
Added to database: 07/30/2026, 15:50:41 UTC
Last enriched: 07/30/2026, 19:22:16 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.