CVE-2025-68366

What it actually does

Use-after-free in NBD driver's reference counting during NBD_CMD_CONNECT and NBD_CLEAR_SOCK operations, where refcount_inc is performed on a config_refs value that has already reached zero after socket close.

Why it matters to the business

Kernel instability or crashes on systems using network block devices for storage, increasing operational risk in environments with high NBD usage; patch urgency remains low given absence from known exploited lists and stable EPSS.

How an attack unfolds

An attacker with local access issues concurrent NBD connect and clear socket operations, inserting timing delays to trigger the race that allows refcount_inc on a freed object, reproducing the use-after-free warning shown in the kernel log.

How to fix it

Apply the upstream fix from commit 330d688a5ca53857828081a3cf31b92ad1b0b3ed in the Linux kernel; for Chainguard packages update keda-fips, keda-admission-webhooks-fips, and keda-metrics-apiserver-fips to version 2.16.1-r4 or later.

How to confirm the fix worked

Verify the presence of the fixing commit in the running kernel source or confirm package versions match the listed fixed releases; test NBD connect/clear operations under load to ensure no refcount warnings occur.

Typical attack path

1. Obtain local access on a system with NBD support enabled
2. Issue NBD_CMD_CONNECT via nbd_genl_connect while holding config_refs
3. Trigger NBD_CLEAR_SOCK followed by close to drop refs to zero
4. Force a delay before refcount_inc to hit the freed reference
5. Observe refcount warning and potential memory corruption

How to detect it

Search kernel logs and dmesg for the exact refcount warning string and the nbd_genl_connect stack trace; correlate with NBD device activity around the time of the warning.

• refcount_t: addition on 0; use-after-free
• nbd_genl_connect+0x16d0/0x1ab0
• WARNING: CPU:.*PID:.*at lib/refcount.c:25 refcount_warn_saturate
• before sleep
• after sleep

What your security team should do

• Prioritize kernel and affected package upgrades within normal maintenance windows
• Monitor kernel logs for refcount warnings on NBD-enabled hosts
• Limit NBD usage to trusted networks until patches are deployed
• Review downstream dependents for any indirect exposure through container images