CVE-2025-68372 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
nbd: defer config put in recv_work
There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open // conf_ref=3 recv_work A done // conf_ref=2 NBD_CLEAR_SOCK // conf_ref=1 nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B) close nbd // conf_ref=1 recv_work B config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF
Or only running NBD_CLEAR_SOCK: nbd_genl_connect // conf_ref=2 nbd_open // conf_ref=3 NBD_CLEAR_SOCK // conf_ref=2 close nbd nbd_release config_put // conf_ref=1 recv_work config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF
Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared.
However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup.
Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear + reconfigure interleave.
In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock):
path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2 NBD_CLEAR_SOCK close nbd nbd_release nbd_disconnect_and_put flush_workqueue // recv_work done nbd_config_put nbd_put // nbd_refs=1 nbd_put // nbd_refs=0 queue_work
path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3 NBD_CLEAR_SOCK // conf_refs=2 close nbd nbd_release nbd_config_put // conf_refs=1 nbd_put // nbd_refs=2 recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0
Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/12/2026
The vulnerability described in CVE-2025-68372 affects the Linux kernel's Network Block Device (NBD) implementation, specifically within the recv_work function. This issue manifests as a use-after-free (UAF) condition that arises due to improper handling of reference counting during socket configuration changes. The flaw occurs when NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE commands are processed in sequence, leading to a race condition where the configuration object is freed while worker threads are still referencing it.
The technical root cause involves the incorrect ordering of operations within the recv_work execution path. When a configuration is cleared and reconfigured, the reference count management becomes problematic. Initially, the configuration reference count is incremented during connection and opening operations, creating a scenario where multiple references exist. During the NBD_CLEAR_SOCK operation, the reference count drops, but the recv_work thread continues execution and attempts to decrement the reference count again, resulting in a freed memory access. This pattern is consistent with CWE-416, which describes use-after-free vulnerabilities that occur when memory is accessed after it has been freed.
The operational impact of this vulnerability is significant as it can lead to system instability, potential privilege escalation, or denial of service conditions. Attackers could exploit this flaw by initiating specific sequences of NBD commands that trigger the race condition, potentially causing kernel memory corruption. The vulnerability is particularly concerning in environments where NBD is actively used for remote block device access, as it could be leveraged to compromise system integrity. The issue aligns with ATT&CK technique T1068, which involves exploiting vulnerabilities in legitimate system processes, and T1499, which covers resource hijacking through kernel exploits.
The fix implemented addresses this by moving the nbd_config_put() call to the end of the recv_work function, ensuring that the configuration reference remains valid for the entire duration of the worker thread's execution. This approach prevents the freed configuration from being accessed by any ongoing recv_work threads, even when interleaved clear and reconfigure operations occur. The solution directly addresses the problematic commit 87aac3a80af5 that had previously moved the config_put operation ahead of the waiter notification, but failed to account for the fact that nbd_start_device_ioctl() explicitly flushes workqueues afterward, making the early config_put unnecessary. The fix ensures proper reference counting behavior across both netlink connection paths with and without NBD_CFLAG_DESTROY_ON_DISCONNECT flags, preventing potential deadlocks while maintaining system stability. This resolution aligns with best practices for kernel memory management and follows the principle of holding references for the complete lifetime of objects being accessed by concurrent threads.