CVE-2025-68372nbd: defer config put in recv_work
- —Not scoredno CVSS score yet
- 0.20%Exploitation in 30 daysEPSS · top 90% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open // conf_ref=3 recv_work A done // conf_ref=2 NBD_CLEAR_SOCK // conf_ref=1 nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B) close nbd // conf_ref=1 recv_work B config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Or only running NBD_CLEAR_SOCK: nbd_genl_connect // conf_ref=2 nbd_open // conf_ref=3 NBD_CLEAR_SOCK // conf_ref=2 close nbd nbd_release config_put // conf_ref=1 recv_work config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared. However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup. Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear + reconfigure interleave. In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock): path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2 NBD_CLEAR_SOCK close nbd nbd_release nbd_disconnect_and_put flush_workqueue // recv_work done nbd_config_put nbd_put // nbd_refs=1 nbd_put // nbd_refs=0 queue_work path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3 NBD_CLEAR_SOCK // conf_refs=2 close nbd nbd_release nbd_config_put // conf_refs=1 nbd_put // nbd_refs=2 recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0 Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
Timeline
ID reserved
By Linux
- 8 days later
· 8 days later
Published
- 6 months later
· 6 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.
- EPSS (exploitation in 30 days)
- 0.20% · top 90% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < 198aa230a6f8c1f6af7ed26b29180749c3e79e4d
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < d3ba312675911ff9e3fefefd551751e153a9f0a9
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < 3692884bd6187d89d41eef81e5a9724519fd01c1
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < 1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < 6b69593f72e1bfba6ca47ca8d9b619341fded7d6
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < 443a1721806b6ff6303b5229e9811d68172d622f
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < 742012f6bf29553fdc460bf646a58df3a7b43d01
- affected 87aac3a80af5cbad93e63250e8a1e19095ba0d30 – < 9517b82d8d422d426a988b213fdd45c6b417b86d
- affected 0a4e383fc3aa6540f804c4fd1184a96ae5de6ef8
- affected 2ef6f4bd60411934e3fc2715442c2afe70f84bf3
- affected 742fd49cf811ca164489e339b862e3fb8e240a73
- affected 14df8724aeeef338172e2a2d6efadc989921ca0f
- affected 4.14.204 – < 4.15
- affected 4.19.155 – < 4.20
- affected 5.4.75 – < 5.5
- affected 5.9.5 – < 5.10
- affected 5.10
- unaffected < 5.10
- unaffected 5.10.248 – ≤ 5.10.*
- unaffected 5.15.198 – ≤ 5.15.*
- unaffected 6.1.160 – ≤ 6.1.*
- unaffected 6.6.120 – ≤ 6.6.*
- unaffected 6.12.63 – ≤ 6.12.*
- unaffected 6.17.13 – ≤ 6.17.*
- unaffected 6.18.2 – ≤ 6.18.*
- unaffected 6.19 – ≤ *
References
References8
- https://git.kernel.org/stable/c/198aa230a6f8c1f6af7ed26b29180749c3e79e4d (opens in a new tab)
- https://git.kernel.org/stable/c/d3ba312675911ff9e3fefefd551751e153a9f0a9 (opens in a new tab)
- https://git.kernel.org/stable/c/3692884bd6187d89d41eef81e5a9724519fd01c1 (opens in a new tab)
- https://git.kernel.org/stable/c/1ba2ced2bbdf7e64a30c3e88c70ea8bc208d1509 (opens in a new tab)
- https://git.kernel.org/stable/c/6b69593f72e1bfba6ca47ca8d9b619341fded7d6 (opens in a new tab)
- https://git.kernel.org/stable/c/443a1721806b6ff6303b5229e9811d68172d622f (opens in a new tab)
- https://git.kernel.org/stable/c/742012f6bf29553fdc460bf646a58df3a7b43d01 (opens in a new tab)
- https://git.kernel.org/stable/c/9517b82d8d422d426a988b213fdd45c6b417b86d (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-205082 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-68372)Record last updated .