CVE-2025-21731

What it actually does

Use-after-free vulnerability in nbd_config caused by allowing nbd_genl_reconfigure after nbd_genl_disconnect clears references but before final put, leading to freed memory access in recv_work.

Why it matters to the business

Linux systems using network block devices may experience crashes, instability, or potential privilege escalation during storage operations, increasing downtime and security risk for affected kernels.

How an attack unfolds

An attacker with local access triggers a sequence of NBD disconnect followed by reconnect operations to race the reference counting, causing the recv_work handler to dereference a freed nbd_config structure.

How to fix it

Upgrade the Linux kernel to a version containing commit e70a578487a47d7cf058904141e586684d1c3381 which clears NBD_RT_BOUND during disconnect to prevent reconfigure after disconnect.

How to confirm the fix worked

Verify the presence of the fix by inspecting nbd_genl_disconnect in the kernel source for the NBD_RT_BOUND clear operation, or confirm the commit hash in the running kernel build.

Typical attack path

1. Obtain ability to issue NBD generic netlink commands
2. Call nbd_genl_disconnect to flush work and drop initial config reference
3. Grab temporary reference to nbd_config
4. Invoke nbd_genl_reconfigure to re-queue recv_work
5. Release the temporary reference so recv_work triggers UAF on the now-freed config

How to detect it

Review kernel logs and audit records for repeated NBD disconnect and reconfigure sequences around the time of crashes or suspicious activity on systems with NBD enabled.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NBD devices
• Restrict unprivileged access to NBD netlink interfaces until patched
• Audit environments for NBD usage and schedule reboots after updates