cbcvebase.
CVE-2025-38443
published 2025-07-25

CVE-2025-38443: In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block…

high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work. This patch moves nbd_start_device() after the backend file creation.

Affected

33 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux——
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux——
linuxlinux>= 6497ef8df568afbf5f3e38825a4590ff41611a54 < cb121c47f364b51776c4db904a6a5a90ab0a7ec5cb121c47f364b51776c4db904a6a5a90ab0a7ec5
linuxlinux>= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 91fa560c73a8126868848ed6cd70607cbf8d87e291fa560c73a8126868848ed6cd70607cbf8d87e2
linuxlinux>= 6497ef8df568afbf5f3e38825a4590ff41611a54 < d46186eb7bbd9a11c145120f2d77effa8d4d44c2d46186eb7bbd9a11c145120f2d77effa8d4d44c2
linuxlinux>= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 8586552df591e0a367eff44af0c586213eeecc3f8586552df591e0a367eff44af0c586213eeecc3f
linuxlinux>= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 002aca89753f666d878ca0eb8584c372684ac4ba002aca89753f666d878ca0eb8584c372684ac4ba
linuxlinux>= 6497ef8df568afbf5f3e38825a4590ff41611a54 < aa9552438ebf015fc5f9f890dbfe39f0c53cf37eaa9552438ebf015fc5f9f890dbfe39f0c53cf37e
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.41-16.12.41-1
linuxlinux_kernel>= 0 < 6.16.3-16.16.3-1
linuxlinux_kernel>= 0 < 5.15.0-156.1665.15.0-156.166
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 5.14 < 5.15.1895.15.189
linuxlinux_kernel>= 5.16 < 6.1.1466.1.146
linuxlinux_kernel>= 6.13 < 6.15.76.15.7
linuxlinux_kernel>= 6.2 < 6.6.996.6.99
linuxlinux_kernel>= 6.7 < 6.12.396.12.39
msrcazl3_kernel_6.6.96.2-1_on_azure_linux_3.0——
msrcazl3_kernel_6.6.96.2-2_on_azure_linux_3.0——
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0——
ubuntulinux-aws——

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH