CVE-2025-68372

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nbd: defer config put in recv_work

There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and

NBD_CMD_RECONFIGURE:

nbd_genl_connect // conf_ref=2 (connect and recv_work A)

nbd_open // conf_ref=3

recv_work A done // conf_ref=2

NBD_CLEAR_SOCK // conf_ref=1

nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)

close nbd // conf_ref=1

recv_work B

config_put // conf_ref=0

atomic_dec(&config->recv_threads); -> UAF

Or only running NBD_CLEAR_SOCK:

nbd_genl_connect // conf_ref=2

nbd_open // conf_ref=3

NBD_CLEAR_SOCK // conf_ref=2

close nbd

nbd_release

config_put // conf_ref=1

recv_work

config_put // conf_ref=0

atomic_dec(&config->recv_threads); -> UAF

Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the

waiter") moved nbd_config_put() to run before waking up the waiter in

recv_work, in ord

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References