CVE-2025-21731: nbd: don't allow reconnect after disconnect
In the Linux kernel, the following vulnerability has been resolved:
nbd: don't allow reconnect after disconnect
Following process can cause nbdconfig UAF:
1) grab nbdconfig temporarily;
2) nbdgenldisconnect() flush all recvwork() and release the initial reference:
nbdgenldisconnect nbddisconnectandput nbddisconnect flushworkqueue(nbd->recvworkq) if (testandclearbit(NBDRTHASCONFIGREF, ...)) nbdconfigput -> due to step 1), reference is still not zero
3) nbdgenlreconfigure() queue recvwork() again;
nbdgenlreconfigure config = nbdgetconfigunlocked(nbd) if (!config) -> succeed if (!testbit(NBDRTBOUND, ...)) -> succeed nbdreconnectsocket queuework(nbd->recvworkq, &args->work)
4) step 1) release the reference;
5) Finially, recvwork() will trigger UAF:
recvwork nbdconfigput(nbd) -> nbdconfig is freed atomicdec(&config->recvthreads) -> UAF
Fix the problem by clearing NBDRTBOUND in nbdgenldisconnect(), so that nbdgenlreconfigure() will fail.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21731?
CVE-2025-21731 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21731?
To mitigate CVE-2025-21731, it is recommended to update to the latest version of the Linux kernel where the vulnerability has been patched.
What components are affected by CVE-2025-21731?
CVE-2025-21731 primarily affects the nbd (Network Block Device) component of the Linux kernel.
What type of vulnerability is CVE-2025-21731?
CVE-2025-21731 is a use-after-free (UAF) vulnerability that can lead to potential arbitrary code execution.
Can CVE-2025-21731 be exploited remotely?
Yes, CVE-2025-21731 could potentially be exploited remotely if the affected nbd service is improperly configured.