In the Linux kernel, the following vulnerability has been resolved:
nbd: don't allow reconnect after disconnect
Following process can cause nbd_config UAF:
1) grab nbd_config temporarily;
2) nbdgenldisconnect() flush all recv_work() and release the initial reference:
nbdgenldisconnect nbddisconnectandput nbddisconnect flushworkqueue(nbd->recvworkq) if (testandclearbit(NBDRTHASCONFIGREF, ...)) nbdconfig_put -> due to step 1), reference is still not zero
3) nbdgenlreconfigure() queue recv_work() again;
nbdgenlreconfigure config = nbdgetconfigunlocked(nbd) if (!config) -> succeed if (!testbit(NBDRTBOUND, ...)) -> succeed nbdreconnectsocket queuework(nbd->recvworkq, &args->work)
4) step 1) release the reference;
5) Finially, recv_work() will trigger UAF:
recvwork nbdconfigput(nbd) -> nbdconfig is freed atomicdec(&config->recvthreads) -> UAF
Fix the problem by clearing NBDRTBOUND in nbdgenldisconnect(), so that nbdgenlreconfigure() will fail.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"699326787846938851365100197224817744",
"122048716619548641846037265187885131389",
"117749870126266874328795727448288524113",
"159966175314657716850119676852839367004"
]
},
"id": "CVE-2025-21731-156d30b1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bef6222a3f6c7adb6396f77f25a3579d821b09a",
"target": {
"file": "drivers/block/nbd.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "6949771587860316424807802045132278599",
"length": 419.0
},
"id": "CVE-2025-21731-6cf15350",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bef6222a3f6c7adb6396f77f25a3579d821b09a",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_disconnect_and_put"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"127515845661146426292071861489989125611",
"122048716619548641846037265187885131389",
"117749870126266874328795727448288524113",
"159966175314657716850119676852839367004"
]
},
"id": "CVE-2025-21731-eb874395",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739",
"target": {
"file": "drivers/block/nbd.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "40851542867628688017683270152490708081",
"length": 392.0
},
"id": "CVE-2025-21731-f9959c5a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_disconnect_and_put"
}
}
]