CVE-2025-40080: nbd: restrict sockets to TCP and UDP
In the Linux kernel, the following vulnerability has been resolved:
nbd: restrict sockets to TCP and UDP
Recently, syzbot started to abuse NBD with all kinds of sockets.
Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method.
Explicitely accept TCP and UNIX stream sockets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict NBD sockets to TCP and UDP during setup so that only supported socket types are accepted (per: "nbd: restrict sockets to TCP and UDP" / verify supported sockets including shutdown() support).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40080?
The severity of CVE-2025-40080 has not been explicitly rated, but it involves a vulnerability in the Linux kernel regarding unsupported socket types.
How do I fix CVE-2025-40080?
To fix CVE-2025-40080, update to the latest version of the Linux kernel where this vulnerability has been addressed.
What versions of Linux Kernel are affected by CVE-2025-40080?
All versions of the Linux kernel prior to the application of the patch related to CVE-2025-40080 are affected.
What is the impact of CVE-2025-40080 on system security?
CVE-2025-40080 could potentially allow unauthorized access to kernel-level resources, impacting system security.
Has CVE-2025-40080 been exploited in the wild?
As of now, there is no public information indicating that CVE-2025-40080 has been actively exploited in the wild.