The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ublk: clean up user copy references on ublk server exit If a ublk server process releases a ublk char     device file, any requests dispatched to the ublk server but not yet completed will retain a ref value of     UBLK_REFCOUNT_INIT. Before commit e63d2228ef83 (ublk: simplify aborting ublk request), __ublk_fail_req()     would decrement the reference count before completing the failed request. However, that commit optimized
    __ublk_fail_req() to call __ublk_complete_rq() directly without decrementing the request reference count.
    The leaked reference count incorrectly allows user copy and zero copy operations on the completed ublk     request. It also triggers the WARN_ON_ONCE(refcount_read(&io->ref)) warnings in ublk_queue_reinit() and     ublk_deinit_queue(). Commit c5c5eb24ed61 (ublk: avoid ublk_io_release() called after ublk char dev is     closed) already fixed the issue for ublk devices using UBLK_F_SUPPORT_ZERO_COPY or UBLK_F_AUTO_BUF_REG.
    However, the reference count leak also affects UBLK_F_USER_COPY, the other reference-counted data copy     mode. Fix the condition in ublk_check_and_reset_active_ref() to include all reference-counted data copy     modes. This ensures that any ublk requests still owned by the ublk server when it exits have their     reference counts reset to 0. (CVE-2025-71070)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-71070

high Nessus Plugin ID 283592

Version 1.5