CVE-2025-21731 nbd: don't allow reconnect after disconnect
A use-after-free vulnerability in the Linux kernel's NBD driver allows local attackers to execute arbitrary code or escalate privileges via a race condition during disconnect and reconnect operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21731?
CVE-2025-21731 is a high-severity use after free vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nbd: don't allow reconnect after disconnect
Following process can cause nbd_config UAF:
1) grab nbd_config temporarily;
2) nbd_genl_disconnect() flush all recv_work() and release the initial reference:
nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero
3) nbd_genl_reconfigure() queue recv_work() again;
nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work)
4) step 1) release the reference;
5) Finially, recv_work() will trigger UAF:
recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF
Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.
Weakness: CWE-416
Which versions are affected by CVE-2025-21731?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21731?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-21731 being exploited?
There is no known exploitation of CVE-2025-21731 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-59043, BELL-CVE-2025-21731, DEBIAN-CVE-2025-21731, GHSA-2qfv-5w3v-jvfv, ROOT-OS-UBUNTU-2404-CVE-2025-21731, UBUNTU-CVE-2025-21731.