nbd: defer config put in recv_work

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-68372
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-12-24 11:16:00 UTC
Updated2026-10-13 11:10:00 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open // conf_ref=3 recv_work A done // conf_ref=2 NBD_CLEAR_SOCK // conf_ref=1 nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B) close nbd // conf_ref=1 recv_work B config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Or only running NBD_CLEAR_SOCK: nbd_genl_connect // conf_ref=2 nbd_open // conf_ref=3 NBD_CLEAR_SOCK // conf_ref=2 close nbd nbd_release config_put // conf_ref=1 recv_work config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared. However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup. Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear + reconfigure interleave. In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock): path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2 NBD_CLEAR_SOCK close nbd nbd_release nbd_disconnect_and_put flush_workqueue // recv_work done nbd_config_put nbd_put // nbd_refs=1 nbd_put // nbd_refs=0 queue_work path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3 NBD_CLEAR_SOCK // conf_refs=2 close nbd nbd_release nbd_config_put // conf_refs=1 nbd_put // nbd_refs=2 recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0 Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 198aa230a6f8c1f6af7ed26b29180749c3e79e4d git Not specified
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 d3ba312675911ff9e3fefefd551751e153a9f0a9 git Not specified
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 3692884bd6187d89d41eef81e5a9724519fd01c1 git Not specified
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509 git Not specified
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 6b69593f72e1bfba6ca47ca8d9b619341fded7d6 git Not specified
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 443a1721806b6ff6303b5229e9811d68172d622f git Not specified
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 742012f6bf29553fdc460bf646a58df3a7b43d01 git Not specified
CNA Linux Linux affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 9517b82d8d422d426a988b213fdd45c6b417b86d git Not specified
CNA Linux Linux affected 0a4e383fc3aa6540f804c4fd1184a96ae5de6ef8 git Not specified
CNA Linux Linux affected 2ef6f4bd60411934e3fc2715442c2afe70f84bf3 git Not specified
CNA Linux Linux affected 742fd49cf811ca164489e339b862e3fb8e240a73 git Not specified
CNA Linux Linux affected 14df8724aeeef338172e2a2d6efadc989921ca0f git Not specified
CNA Linux Linux affected 4.14.204 4.15 semver Not specified
CNA Linux Linux affected 4.19.155 4.20 semver Not specified
CNA Linux Linux affected 5.4.75 5.5 semver Not specified
CNA Linux Linux affected 5.9.5 5.10 semver Not specified
CNA Linux Linux affected 5.10 Not specified
CNA Linux Linux unaffected 5.10 semver Not specified
CNA Linux Linux unaffected 5.10.248 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.198 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.160 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.120 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.63 6.12.* semver Not specified
CNA Linux Linux unaffected 6.17.13 6.17.* semver Not specified
CNA Linux Linux unaffected 6.18.2 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/742012f6bf29553fdc460bf646a58df3a7b43d01 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6b69593f72e1bfba6ca47ca8d9b619341fded7d6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/198aa230a6f8c1f6af7ed26b29180749c3e79e4d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d3ba312675911ff9e3fefefd551751e153a9f0a9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3692884bd6187d89d41eef81e5a9724519fd01c1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/443a1721806b6ff6303b5229e9811d68172d622f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9517b82d8d422d426a988b213fdd45c6b417b86d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report