CVE-2025-68366

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nbd: defer config unlock in nbd_genl_connect

There is one use-after-free warning when running NBD_CMD_CONNECT and

NBD_CLEAR_SOCK:

nbd_genl_connect

nbd_alloc_and_init_config // config_refs=1

nbd_start_device // config_refs=2

set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3

recv_work done // config_refs=2

NBD_CLEAR_SOCK // config_refs=1

close nbd // config_refs=0

refcount_inc -> uaf

------------[ cut here ]------------

refcount_t: addition on 0; use-after-free.

WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290

nbd_genl_connect+0x16d0/0x1ab0

genl_family_rcv_msg_doit+0x1f3/0x310

genl_rcv_msg+0x44a/0x790

The issue can be easily reproduced by adding a small delay before

refcount_inc(&nbd->config_refs) in nbd_genl_connect():

mutex_unlock(&nbd->config_lock);

if (!ret) {

set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);

+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References