CVE-2025-71070: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71070 is a reference count leak vulnerability in the Linux kernel's ublk (userspace block device) subsystem, specifically in the handling of user copy references when a ublk server process exits. When a ublk server releases a ublk char device file, in-flight requests retain a non-zero reference count (UBLK_REFCOUNT_INIT) due to an optimization introduced in commit e63d2228ef83 that bypassed the reference count decrement in __ublk_fail_req(). This affects the UBLK_F_USER_COPY data copy mode, which was not covered by the prior partial fix (commit c5c5eb24ed61) that addressed UBLK_F_SUPPORT_ZERO_COPY and UBLK_F_AUTO_BUF_REG. The vulnerability was published on January 13, 2026, and affects Linux kernel versions from commit e63d2228ef83 up to the patched commits. No official CVSS score has been assigned by NVD; Feedly estimates it as Medium severity with an EPSS score of 0.000180 (Feedly, NVD).

The root cause is an improper reference count management (related to CWE-911: Improper Update of Reference Count) in the Linux kernel's ublk subsystem. Commit e63d2228ef83 optimized __ublk_fail_req() to call __ublk_complete_rq() directly without first decrementing the io->ref reference count, causing a reference count leak when the ublk server exits with pending requests. This leaked reference count incorrectly permits user copy and zero copy operations on already-completed ublk requests, and also triggers WARN_ON_ONCE(refcount_read(&io->ref)) kernel warnings in ublk_queue_reinit() and ublk_deinit_queue(). The fix modifies ublk_check_and_reset_active_ref() to cover all reference-counted data copy modes, including UBLK_F_USER_COPY, ensuring reference counts are reset to 0 on server exit (NVD, Kernel Patch 1, Kernel Patch 2).

The leaked reference count allows unauthorized user copy or zero copy operations on completed ublk requests after the ublk server has exited, which could lead to use-after-completion memory access and potential data corruption or information disclosure within the kernel's block I/O subsystem. Additionally, the spurious WARN_ON_ONCE kernel warnings in ublk_queue_reinit() and ublk_deinit_queue() can disrupt normal kernel operation and complicate diagnostics. The vulnerability is local in scope, requiring the ability to run a ublk server process on the affected system, and does not directly enable remote code execution (NVD, Feedly).

• Logs: Kernel log entries containing WARN_ON_ONCE(refcount_read(&io->ref)) originating from ublk_queue_reinit() or ublk_deinit_queue() in /var/log/kern.log or dmesg output.
• Process: Unexpected ublk server process termination while block I/O requests are in flight, potentially observable via system audit logs or process monitoring tools.

The fix is included in two upstream Linux kernel stable commits: 13456b4f1033d911f8bf3a0a1195656f293ba0f6 and daa24603d9f0808929514ee62ced30052ca7221c, which correct ublk_check_and_reset_active_ref() to cover all reference-counted data copy modes. Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this vulnerability. Administrators should update to a patched kernel version as provided by their Linux distribution; as a workaround, avoiding use of UBLK_F_USER_COPY mode reduces exposure until a patch can be applied (Ubuntu USN-8177-1, Ubuntu USN-8183-1, Kernel Patch 1).