CVE-2025-68366

Vulnerability

Description

A use-after-free vulnerability exists in the Linux kernel's Network Block Device (NBD) driver when processing NBD_CMD_CONNECT and NBD_CLEAR_SOCK commands concurrently. The root cause is that nbd_genl_connect releases the config_lock mutex before incrementing the config_refs reference count via refcount_inc. This makes the reference count susceptible to a race condition where an NBD device's configuration can be freed before the reference is safely incremented, causing a use-after-free on the nbd structure [1].

Attack

Scenario

Exploitation requires an unprivileged user or process to send a crafted sequence of Netlink messages: first, an NBD_CMD_CONNECT request that triggers device startup and increments the config reference count, and then, during the race window, an NBD_CLEAR_SOCK and NBD_CLEAR_SOCK to tear down the device and decrement the reference count to zero. If the timing is correct, the subsequent refcount_inc in nbd_genl_connect will operate on freed memory [2]. The race window can be artificially widened (e.g., by adding a delay in the code, as demonstrated in the bug report) making the race reliably exploitable.

Impact

A successful attack results in a use-after-free condition on kernel memory, which can lead to system crash (denial of service) or, given the right heap layout, arbitrary code execution with kernel privileges. The vulnerability has a CVSS v3.1 base score of 7.8 (High) because it requires local access but no authentication and can be triggered with low privileges [1][2].

Mitigation

The fix (commit 9a3830664387 in the Linux kernel stable tree [1]) ensures that config_unlock is deferred until after the refcount_inc and reply transmission in nbd_genl_connect, eliminating the race window. Users are advised to update their Linux kernel to a version containing this patch. No workaround is available other than applying the kernel update.