In the Linux kernel, the following vulnerability has been resolved:
nbd: don't allow reconnect after disconnect
Following process can cause nbd_config UAF:
1) grab nbd_config temporarily;
2) nbd_genl_disconnect() flush all recv_work() and release the initial reference:
nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero
3) nbd_genl_reconfigure() queue recv_work() again;
nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work)
4) step 1) release the reference;
5) Finially, recv_work() will trigger UAF:
recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF
Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.235-227.919Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.179-121.185Upgrade bpftoolUpgrade kernel-tools-develUpgrade perfUpgrade kernel-livepatch-4.14.355-276.618Upgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools | Apr 2, 2025 | Feb 27, 2025 |
| Amazon_linux | — | Upgrade kernel | Apr 18, 2025 | Feb 27, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade perfUpgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-libbpf-debuginfoUpgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.131-143.221Upgrade bpftool | Apr 2, 2025 | Feb 27, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Mar 17, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | May 13, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade python3-perf | Jun 13, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libs | Jun 11, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Jun 11, 2025 | Feb 27, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2025 |
| Suse | — | Upgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-obs-qaUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade reiserfs-kmp-azureUpgrade dtb-amlogicUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade kernel-docsUpgrade kernel-default-optionalUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-azureUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade kernel-symsUpgrade dlm-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-debugUpgrade kernel-macrosUpgrade cluster-md-kmp-rtUpgrade kernel-defaultUpgrade kernel-devel-rtUpgrade dtb-armUpgrade cluster-md-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade dtb-nvidiaUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-rt-develUpgrade kernel-source-vanillaUpgrade dtb-exynosUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-defaultUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-64kbUpgrade dtb-sprdUpgrade dtb-renesasUpgrade kernel-azureUpgrade kernel-rt_debug-develUpgrade dtb-amazonUpgrade kernel-rt-livepatch-develUpgrade kernel-default-develUpgrade gfs2-kmp-azureUpgrade dtb-marvellUpgrade dtb-hisiliconUpgrade kernel-default-manUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade kernel-source-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-64kbUpgrade dtb-broadcomUpgrade dtb-amdUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade dtb-lgUpgrade dtb-caviumUpgrade dtb-freescaleUpgrade kernel-rt_debugUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade dtb-socionextUpgrade dtb-appleUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-sourceUpgrade kernel-rt-vdsoUpgrade kernel-azure-develUpgrade kernel-obs-buildUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade dtb-alteraUpgrade kernel-docs-htmlUpgrade kernel-azure-optionalUpgrade kernel-64kb-extra | Apr 9, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1084-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gkeopUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-ibm-6.8Upgrade linux-image-oem-20.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1078-nvidiaUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1105-bluefieldUpgrade linux-image-6.8.0-1029-oracle-64kUpgrade linux-image-5.15.0-1080-kvmUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1029-oracleUpgrade linux-image-6.8.1-1025-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1050-xilinx-zynqmpUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-5.4.0-1151-azure-fipsUpgrade linux-image-5.15.0-142-generic-lpaeUpgrade linux-image-5.15.0-142-genericUpgrade linux-image-gkeUpgrade linux-image-intelUpgrade linux-image-intel-iotgUpgrade linux-image-aws-64k-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-5.15.0-1084-awsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-virtualUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-gke-5.15Upgrade linux-image-6.11.0-26-genericUpgrade linux-image-oem-20.04cUpgrade linux-image-kvmUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-6.11.0-1015-gcpUpgrade linux-image-6.11.0-1015-azure-fdeUpgrade linux-image-6.11.0-1014-lowlatency-64kUpgrade linux-image-6.11.0-1016-oracleUpgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-5.15.0-1083-gcpUpgrade linux-image-5.15.0-140-generic-lpaeUpgrade linux-image-oracle-6.8Upgrade linux-image-5.15.0-142-generic-64kUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oem-22.04bUpgrade linux-image-6.11.0-1010-realtimeUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-gcpUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-aws-64kUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1032-awsUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-6.8.0-64-genericUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1151-azureUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1029-ibmUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1031-nvidia-64kUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-5.15.0-140-fipsUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-ibmUpgrade linux-image-5.15.0-1084-aws-fipsUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-tegraUpgrade linux-image-aws-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-raspi2Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1076-ibmUpgrade linux-image-6.11.0-1014-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-20.04dUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-140-genericUpgrade linux-image-5.4.0-1146-awsUpgrade linux-image-6.8.0-64-lowlatencyUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-6.11.0-1014-awsUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1081-oracleUpgrade linux-image-6.11.0-1013-raspiUpgrade linux-image-6.8.0-1031-nvidiaUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1033-gcp-64kUpgrade linux-image-6.11.0-1016-oracle-64kUpgrade linux-image-fipsUpgrade linux-image-lowlatency-6.8Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-6.8.0-1031-nvidia-lowlatencyUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1031-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-2026-raspi-realtimeUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-5.4.0-1146-aws-fipsUpgrade linux-image-azure-fdeUpgrade linux-image-gcp-6.8Upgrade linux-image-5.15.0-1089-azure-fipsUpgrade linux-image-5.4.0-1149-gcp-fipsUpgrade linux-image-awsUpgrade linux-image-6.8.0-1033-gcpUpgrade linux-image-5.15.0-1026-nvidia-tegra-igx-rtUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-bluefieldUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-aws-6.8Upgrade linux-image-5.15.0-140-lowlatency-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-6.11.0-1015-azureUpgrade linux-image-5.4.0-1064-xilinx-zynqmpUpgrade linux-image-realtime-6.8.1Upgrade linux-image-gkeop-5.15Upgrade linux-image-aws-lts-20.04Upgrade linux-image-6.11.0-1022-oemUpgrade linux-image-5.15.0-140-lowlatencyUpgrade linux-image-virtual-6.8Upgrade linux-image-5.4.0-1120-fipsUpgrade linux-image-5.15.0-1066-gkeopUpgrade linux-image-raspiUpgrade linux-image-6.8.0-64-lowlatency-64kUpgrade linux-image-5.15.0-1037-nvidia-tegraUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1015-gkeopUpgrade linux-image-5.4.0-1149-gcpUpgrade linux-image-raspi-6.8Upgrade linux-image-azure-nvidiaUpgrade linux-image-6.8.0-1031-oemUpgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-lpaeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1083-gcp-fipsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure-cvmUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1031-raspiUpgrade linux-image-5.15.0-1077-intel-iot-realtimeUpgrade linux-image-5.15.0-1037-nvidia-tegra-rtUpgrade linux-image-oem-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-140-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-5.4.0-1051-iotUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1028-gkeUpgrade linux-image-5.15.0-1089-azureUpgrade linux-image-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-5.4.0-216-genericUpgrade linux-image-5.4.0-1144-oracleUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.4.0-1092-ibmUpgrade linux-image-5.15.0-1078-nvidia-lowlatencyUpgrade linux-image-oemUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-5.4.0-1133-kvmUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-216-generic-lpaeUpgrade linux-image-5.15.0-1081-gkeUpgrade linux-image-6.8.0-1032-aws-64kUpgrade linux-image-5.15.0-1079-intel-iotgUpgrade linux-image-oem-24.04bUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.4.0-216-lowlatencyUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-26-generic-64kUpgrade linux-image-6.11.0-1015-gcp-64kUpgrade linux-image-5.15.0-1078-raspiUpgrade linux-image-5.15.0-1026-nvidia-tegra-igxUpgrade linux-image-generic-64k-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-azureUpgrade linux-image-gcp-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-azure-fipsUpgrade linux-image-azure-lts-20.04 | May 20, 2025 | Feb 27, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Feb 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub