Executive brief
A vulnerability has been identified in the Linux kernel's ublk driver, which manages user-space block devices. When a server process managing these devices exits unexpectedly, the system may fail to properly clean up internal references to data requests. This could potentially allow unauthorized data access or cause system instability, impacting the reliability of storage services.
Technical details
A reference count leak exists in the Linux kernel ublk driver (drivers/block/ublk_drv.c) when a ublk server process exits. The vulnerability stems from an optimization in __ublk_fail_req() that bypassed reference count decrements, leaving requests in the UBLK_REFCOUNT_INIT state. While previous fixes addressed UBLK_F_SUPPORT_ZERO_COPY and UBLK_F_AUTO_BUF_REG, the UBLK_F_USER_COPY mode remained vulnerable. This leak allows user copy and zero-copy operations to persist on completed requests and triggers WARN_ON_ONCE in ublk_queue_reinit() and ublk_deinit_queue(). The fix involves updating ublk_check_and_reset_active_ref() to ensure all reference-counted data copy modes are properly reset to zero upon server exit.
Affected products
- Linux Linux Kernel 6.14.6 to 6.15, 6.18.3 to 6.18.*
Timeline
- 2026-01-13: disclosed: Initial advisory publication
- 2026-01-13: advisory: NVD entry created