CVE-2025-68366 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
nbd: defer config unlock in nbd_genl_connect
There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK:
nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 nbd_start_device // config_refs=2 set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3 recv_work done // config_refs=2 NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0 refcount_inc -> uaf
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790
The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect():
mutex_unlock(&nbd->config_lock); if (!ret) {
set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); + printk("before sleep\n"); + mdelay(5 * 1000); + printk("after sleep\n"); refcount_inc(&nbd->config_refs); nbd_connect_reply(info, nbd->index); }
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/12/2026
The vulnerability CVE-2025-68366 represents a use-after-free condition in the Linux kernel's NBD (Network Block Device) subsystem, specifically within the nbd_genl_connect function. This flaw arises from improper handling of reference counting mechanisms during the NBD connection lifecycle, creating a scenario where memory objects can be accessed after they have been freed. The issue manifests when the NBD_CMD_CONNECT and NBD_CLEAR_SOCK commands are processed in sequence, leading to a race condition that allows for memory corruption and potential system instability. The vulnerability is classified under CWE-416 as a use-after-free error, which is a well-known class of memory safety issues that can lead to arbitrary code execution or system crashes.
The technical flaw occurs in the nbd_genl_connect function where the reference count of the NBD configuration object is incremented without proper synchronization guarantees. When NBD_CLEAR_SOCK is processed, it reduces the reference count to zero, causing the configuration object to be freed. However, if a subsequent operation attempts to increment the reference count on this already-freed object, the system triggers a use-after-free condition. The kernel's reference counting mechanism in lib/refcount.c detects this violation and generates a warning message indicating addition on a zero refcount. The specific call trace shows the error occurring at refcount_warn_saturate, demonstrating that the system detected an attempt to increment a reference count that had already been decremented to zero.
The operational impact of this vulnerability extends beyond simple system crashes, as it can potentially enable privilege escalation or denial of service attacks within kernel space. When the use-after-free condition occurs, it can lead to memory corruption that might be exploited to execute arbitrary code with kernel privileges, making this a critical security concern for systems running affected kernel versions. The vulnerability is particularly concerning because it affects the core network block device functionality that many systems rely upon for storage operations. The race condition can be reliably reproduced through a simple delay injection technique, as demonstrated by the test case that introduces a five-second delay before the reference count increment operation, making it both predictable and exploitable.
Mitigation strategies for this vulnerability involve implementing proper synchronization mechanisms and ensuring that reference counting operations are atomic and properly ordered during the NBD connection lifecycle. The recommended approach includes modifying the nbd_genl_connect function to maintain proper locking semantics and ensuring that the configuration object remains valid throughout all operations that might reference it. Kernel patches should enforce that the configuration reference count is only incremented after all necessary cleanup operations have completed, preventing the scenario where a freed object is accessed. Additionally, implementing proper validation checks and ensuring that runtime flags are correctly managed during the connection process can prevent the race condition. Organizations should prioritize applying the relevant kernel patches as soon as they become available, and system administrators should monitor for any signs of memory corruption or unexpected system behavior in environments utilizing NBD functionality. This vulnerability aligns with ATT&CK technique T1068 which covers 'Exploitation for Privilege Escalation' and T1499 which covers 'Endpoint Termination' through the potential for denial of service exploitation.