In the Linux kernel, the following vulnerability has been resolved:
nbd: fix uaf in nbdgenlconnect() error path
There is a use-after-free issue in nbd:
block nbd6: Receive control failed (result -104)
BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67
CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recvwork Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xc3/0x670 mm/kasan/report.c:521 kasanreport+0xe0/0x110 mm/kasan/report.c:634 checkregioninline mm/kasan/generic.c:183 [inline] kasancheckrange+0xef/0x1a0 mm/kasan/generic.c:189 instrumentatomicreadwrite include/linux/instrumented.h:96 [inline] atomicdec include/linux/atomic/atomic-instrumented.h:592 [inline] recvwork+0x694/0xa80 drivers/block/nbd.c:1022 processonework+0x9cc/0x1b70 kernel/workqueue.c:3238 processscheduledworks kernel/workqueue.c:3319 [inline] workerthread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 retfromfork+0x45/0x80 arch/x86/kernel/process.c:153 retfromforkasm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
nbdgenlconnect() does not properly stop the device on certain error paths after nbdstartdevice() has been called. This causes the error path to put nbd->config while recvwork continue to use the config after putting it, leading to use-after-free in recvwork.
This patch moves nbdstartdevice() after the backend file creation.
[
{
"id": "CVE-2025-38443-003fdd93",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91fa560c73a8126868848ed6cd70607cbf8d87e2",
"digest": {
"length": 4033.0,
"function_hash": "333846752340163437386348460752422587902"
},
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_genl_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-624bd21e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@002aca89753f666d878ca0eb8584c372684ac4ba",
"digest": {
"line_hashes": [
"223576844543367586792308060504859143410",
"111566260686887218357385592589534292794",
"89354892206241427178185181413428687060",
"245355756572531716912659744062642808439",
"276250938756594131678064011758383095248",
"277466381036728367875617683326820318659",
"178676002549031746577773005327176485251",
"63663681272193399851121850423842895263",
"288893859126489210717198950192031550934",
"331057227735972979964632110421303456272"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/nbd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-6b13f452",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb121c47f364b51776c4db904a6a5a90ab0a7ec5",
"digest": {
"length": 4297.0,
"function_hash": "133219477683858649062741139109119171513"
},
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_genl_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-70a80920",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa9552438ebf015fc5f9f890dbfe39f0c53cf37e",
"digest": {
"line_hashes": [
"223576844543367586792308060504859143410",
"111566260686887218357385592589534292794",
"89354892206241427178185181413428687060",
"245355756572531716912659744062642808439",
"276250938756594131678064011758383095248",
"277466381036728367875617683326820318659",
"178676002549031746577773005327176485251",
"63663681272193399851121850423842895263",
"288893859126489210717198950192031550934",
"331057227735972979964632110421303456272"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/nbd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-88d84818",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb121c47f364b51776c4db904a6a5a90ab0a7ec5",
"digest": {
"line_hashes": [
"223576844543367586792308060504859143410",
"111566260686887218357385592589534292794",
"89354892206241427178185181413428687060",
"245355756572531716912659744062642808439",
"276250938756594131678064011758383095248",
"277466381036728367875617683326820318659",
"178676002549031746577773005327176485251",
"63663681272193399851121850423842895263",
"288893859126489210717198950192031550934",
"331057227735972979964632110421303456272"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/nbd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-8b206b1e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d46186eb7bbd9a11c145120f2d77effa8d4d44c2",
"digest": {
"line_hashes": [
"223576844543367586792308060504859143410",
"111566260686887218357385592589534292794",
"89354892206241427178185181413428687060",
"245355756572531716912659744062642808439",
"276250938756594131678064011758383095248",
"277466381036728367875617683326820318659",
"178676002549031746577773005327176485251",
"63663681272193399851121850423842895263",
"288893859126489210717198950192031550934",
"331057227735972979964632110421303456272"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/nbd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-8e287871",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d46186eb7bbd9a11c145120f2d77effa8d4d44c2",
"digest": {
"length": 4033.0,
"function_hash": "61393894483805552939302528088589197593"
},
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_genl_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-93191e0d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@002aca89753f666d878ca0eb8584c372684ac4ba",
"digest": {
"length": 4033.0,
"function_hash": "61393894483805552939302528088589197593"
},
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_genl_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-9754c174",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8586552df591e0a367eff44af0c586213eeecc3f",
"digest": {
"line_hashes": [
"223576844543367586792308060504859143410",
"111566260686887218357385592589534292794",
"89354892206241427178185181413428687060",
"245355756572531716912659744062642808439",
"276250938756594131678064011758383095248",
"277466381036728367875617683326820318659",
"178676002549031746577773005327176485251",
"63663681272193399851121850423842895263",
"288893859126489210717198950192031550934",
"331057227735972979964632110421303456272"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/nbd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-adba6d93",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91fa560c73a8126868848ed6cd70607cbf8d87e2",
"digest": {
"line_hashes": [
"223576844543367586792308060504859143410",
"111566260686887218357385592589534292794",
"89354892206241427178185181413428687060",
"245355756572531716912659744062642808439",
"276250938756594131678064011758383095248",
"277466381036728367875617683326820318659",
"178676002549031746577773005327176485251",
"63663681272193399851121850423842895263",
"288893859126489210717198950192031550934",
"331057227735972979964632110421303456272"
],
"threshold": 0.9
},
"target": {
"file": "drivers/block/nbd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-b0532155",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa9552438ebf015fc5f9f890dbfe39f0c53cf37e",
"digest": {
"length": 4033.0,
"function_hash": "61393894483805552939302528088589197593"
},
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_genl_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38443-c675296f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8586552df591e0a367eff44af0c586213eeecc3f",
"digest": {
"length": 4033.0,
"function_hash": "61393894483805552939302528088589197593"
},
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_genl_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
]