CVE-2019-16089

What it actually does

Missing return-value check on nla_nest_start_noflag in nbd_genl_status allows an invalid netlink attribute nest pointer to be used, producing kernel memory corruption or a NULL-dereference panic when handling NBD status requests.

Why it matters to the business

Systems that expose the NBD generic netlink interface can experience local denial-of-service crashes requiring a reboot; the flaw is difficult to reach and has seen no observed exploitation after more than seven years.

How an attack unfolds

An attacker with existing local root privileges crafts a netlink message that triggers the unchecked nla_nest_start_noflag path inside the NBD driver; the resulting invalid pointer use either corrupts kernel memory or immediately panics the system.

How to fix it

Upgrade the Linux kernel to a version later than 5.2.13 that contains the corrected nbd_genl_status implementation; rebuild and reboot all affected systems. Where immediate patching is impossible, restrict unprivileged access to Netlink and the NBD module.

How to confirm the fix worked

Confirm the running kernel is newer than 5.2.13 and inspect drivers/block/nbd.c for an explicit NULL check after the nla_nest_start_noflag call; run regression tests that exercise NBD generic netlink status reporting.

Typical attack path

1. Obtain local root privileges on the target host
2. Load or ensure the nbd kernel module is present
3. Send a crafted Netlink NBD_CMD_STATUS message containing nested attributes that cause nla_nest_start_noflag to fail
4. Trigger kernel panic or memory corruption leading to denial of service

How to detect it

Review kernel logs for oops or panic entries referencing nbd.c or nbd_genl_status; examine auditd or syscall logs for unusual Netlink activity from the NBD generic family by root processes.

What your security team should do

• Prioritize kernel upgrades on any host still running versions 5.2.13 or earlier
• Audit systems for NBD usage and remove the module if not required
• Apply kernel live-patching where available for critical workloads
• Monitor EPSS and KEV updates; the current low, stable EPSS indicates minimal external threat