{"id":"CVE-2025-68366","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-68366","generatedAt":"2026-10-28T05:26:13.670Z","title":"In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config //…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config unlock in nbd_genl_connect\n\nThere is one use-after-free warning when running NBD_CMD_CONNECT and\nNBD_CLEAR_SOCK:\n\nnbd_genl_connect\n  nbd_alloc_and_init_config // config_refs=1\n  nbd_start_device // config_refs=2\n  set NBD_RT_HAS_CONFIG_REF\t\t\topen nbd // config_refs=3\n  recv_work done // config_refs=2\n\t\t\t\t\t\tNBD_CLEAR_SOCK // config_refs=1\n\t\t\t\t\t\tclose nbd // config_refs=0\n  refcount_inc -> uaf\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290\n nbd_genl_connect+0x16d0/0x1ab0\n genl_family_rcv_msg_doit+0x1f3/0x310\n genl_rcv_msg+0x44a/0x790\n\nThe issue can be easily reproduced by adding a small delay before\nrefcount_inc(&nbd->config_refs) in nbd_genl_connect():\n\n        mutex_unlock(&nbd->config_lock);\n        if (!ret) {\n                set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);\n+               printk(\"before sleep\\n\");\n+               mdelay(5 * 1000);\n+               printk(\"after sleep\\n\");\n                refcount_inc(&nbd->config_refs);\n                nbd_connect_reply(info, nbd->index);\n        }","published":"2025-12-24T11:16:00.000Z","lastModified":"2026-10-13T11:10:00.000Z","status":"Deferred","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":null,"cwe":[],"affected":[],"epss":{"score":0.00198,"percentile":0.09481,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/1649714b930f9ea6233ce0810ba885999da3b5d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e5e0665a594f076ef2b9439447bae8be293d09d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/330d688a5ca53857828081a3cf31b92ad1b0b3ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a38306643874566d20f7aba7dff9e6f657b51a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae3e7bc1f4b393ae20e5c85583eb2c6977374716","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9b99c948b4fb014812afe7b5ccf2db121d22e46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9e805f6a35d1dd189a9345595a5c20e87611942","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd93db1b1b4460e6ee77564024ea461e5940f69c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-68366","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}