Linux Kernel ublk Driver Reference Count Leak Vulnerability

A vulnerability in the Linux kernel's ublk driver has been addressed, concerning a reference count leak that could lead to improper user copy operations. When a ublk server process releases a character device file, any pending requests retain an initial reference count, which, if not properly decremented, can allow unauthorized data operations on completed requests. This issue, which triggered warnings about the reference count in the ublk request queue, has been fixed by ensuring that all active references are properly reset when the ublk server exits.

Impact

Exploitation of this vulnerability could lead to a reference count leak, allowing improper user copy operations on ublk requests, and triggering warnings about the leaked reference count in the ublk request queue.

Remediation

Users can apply the latest patch available in the Linux kernel stable tree to address this vulnerability.