{"id":"CVE-2025-38443","title":"nbd: fix uaf in nbd_genl_connect() error path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix uaf in nbd_genl_connect() error path\n\nThere is a use-after-free issue in nbd:\n\nblock nbd6: Receive control failed (result -104)\nblock nbd6: shutting down socke…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < cb121c47f364b51776c4db904a6a5a90ab0a7ec5","Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 91fa560c73a8126868848ed6cd70607cbf8d87e2","Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < d46186eb7bbd9a11c145120f2d77effa8d4d44c2","Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 8586552df591e0a367eff44af0c586213eeecc3f","Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 002aca89753f666d878ca0eb8584c372684ac4ba","Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < aa9552438ebf015fc5f9f890dbfe39f0c53cf37e","Linux 5.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:56:50.472185Z"},"published":"2025-07-25","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:02:38.456Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38443","references":[{"url":"https://git.kernel.org/stable/c/cb121c47f364b51776c4db904a6a5a90ab0a7ec5"},{"url":"https://git.kernel.org/stable/c/91fa560c73a8126868848ed6cd70607cbf8d87e2"},{"url":"https://git.kernel.org/stable/c/d46186eb7bbd9a11c145120f2d77effa8d4d44c2"},{"url":"https://git.kernel.org/stable/c/8586552df591e0a367eff44af0c586213eeecc3f"},{"url":"https://git.kernel.org/stable/c/002aca89753f666d878ca0eb8584c372684ac4ba"},{"url":"https://git.kernel.org/stable/c/aa9552438ebf015fc5f9f890dbfe39f0c53cf37e"}],"tags":["cve.org"],"epss":0.00183,"epssPercentile":0.07958,"ingestedAt":"2026-11-05T22:38:31.973Z","slug":"CVE-2025-38443","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix uaf in nbd_genl_connect() error path\n\nThere is a use-after-free issue in nbd:\n\nblock nbd6: Receive control failed (result -104)\nblock nbd6: shutting down sockets\n==================================================================\nBUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022\nWrite of size 4 at addr ffff8880295de478 by task kworker/u33:0/67\n\nCPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nWorkqueue: nbd6-recv recv_work\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc3/0x670 mm/kasan/report.c:521\n kasan_report+0xe0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\n atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]\n recv_work+0x694/0xa80 drivers/block/nbd.c:1022\n process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3319 [inline]\n worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400\n kthread+0x3c2/0x780 kernel/kthread.c:464\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>\n\nnbd_genl_connect() does not properly stop the device on certain\nerror paths after nbd_start_device() has been called. This causes\nthe error path to put nbd->config while recv_work continue to use\nthe config after putting it, leading to use-after-free in recv_work.\n\nThis patch moves nbd_start_device() after the backend file creation.\n\n## Affected\n\n- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < cb121c47f364b51776c4db904a6a5a90ab0a7ec5`\n- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 91fa560c73a8126868848ed6cd70607cbf8d87e2`\n- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < d46186eb7bbd9a11c145120f2d77effa8d4d44c2`\n- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 8586552df591e0a367eff44af0c586213eeecc3f`\n- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 002aca89753f666d878ca0eb8584c372684ac4ba`\n- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < aa9552438ebf015fc5f9f890dbfe39f0c53cf37e`\n- `Linux 5.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}