Linux Kernel ublk Device Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's ublk device management. This issue arises when the 'add_disk()' function fails, potentially leading to a use-after-free condition. The vulnerability occurs because the 'ublk_abort_requests()' function, which is responsible for aborting all inflight requests, is called when exiting the uring context or handling timeouts. If 'add_disk()' fails, the 'gendisk' may have already been freed by the time 'ublk_abort_requests()' is called, creating the use-after-free scenario.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.