---
id: CVE-2025-38443
title: 'nbd: fix uaf in nbd_genl_connect() error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nbd: fix uaf in nbd_genl_connect() error path

  There is a use-after-free issue in nbd:

  block nbd6: Receive control failed (result -104)
  block nbd6: shutting down socke…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 <
    cb121c47f364b51776c4db904a6a5a90ab0a7ec5
  - >-
    Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 <
    91fa560c73a8126868848ed6cd70607cbf8d87e2
  - >-
    Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 <
    d46186eb7bbd9a11c145120f2d77effa8d4d44c2
  - >-
    Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 <
    8586552df591e0a367eff44af0c586213eeecc3f
  - >-
    Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 <
    002aca89753f666d878ca0eb8584c372684ac4ba
  - >-
    Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 <
    aa9552438ebf015fc5f9f890dbfe39f0c53cf37e
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:56:50.472185Z'
published: '2025-07-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:38.456Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38443'
references:
  - url: 'https://git.kernel.org/stable/c/cb121c47f364b51776c4db904a6a5a90ab0a7ec5'
  - url: 'https://git.kernel.org/stable/c/91fa560c73a8126868848ed6cd70607cbf8d87e2'
  - url: 'https://git.kernel.org/stable/c/d46186eb7bbd9a11c145120f2d77effa8d4d44c2'
  - url: 'https://git.kernel.org/stable/c/8586552df591e0a367eff44af0c586213eeecc3f'
  - url: 'https://git.kernel.org/stable/c/002aca89753f666d878ca0eb8584c372684ac4ba'
  - url: 'https://git.kernel.org/stable/c/aa9552438ebf015fc5f9f890dbfe39f0c53cf37e'
tags:
  - cve.org
epss: 0.00183
epssPercentile: 0.07958
ingestedAt: '2026-11-05T22:38:31.973Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nbd: fix uaf in nbd_genl_connect() error path

There is a use-after-free issue in nbd:

block nbd6: Receive control failed (result -104)
block nbd6: shutting down sockets
==================================================================
BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022
Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67

CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: nbd6-recv recv_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
 recv_work+0x694/0xa80 drivers/block/nbd.c:1022
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

nbd_genl_connect() does not properly stop the device on certain
error paths after nbd_start_device() has been called. This causes
the error path to put nbd->config while recv_work continue to use
the config after putting it, leading to use-after-free in recv_work.

This patch moves nbd_start_device() after the backend file creation.

## Affected

- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < cb121c47f364b51776c4db904a6a5a90ab0a7ec5`
- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 91fa560c73a8126868848ed6cd70607cbf8d87e2`
- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < d46186eb7bbd9a11c145120f2d77effa8d4d44c2`
- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 8586552df591e0a367eff44af0c586213eeecc3f`
- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < 002aca89753f666d878ca0eb8584c372684ac4ba`
- `Linux >= 6497ef8df568afbf5f3e38825a4590ff41611a54 < aa9552438ebf015fc5f9f890dbfe39f0c53cf37e`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.