CVE-2025-21731

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nbd: don&amp;#39;t allow reconnect after disconnect<br /> <br /> Following process can cause nbd_config UAF:<br /> <br /> 1) grab nbd_config temporarily;<br /> <br /> 2) nbd_genl_disconnect() flush all recv_work() and release the<br /> initial reference:<br /> <br /> nbd_genl_disconnect<br /> nbd_disconnect_and_put<br /> nbd_disconnect<br /> flush_workqueue(nbd-&gt;recv_workq)<br /> if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))<br /> nbd_config_put<br /> -&gt; due to step 1), reference is still not zero<br /> <br /> 3) nbd_genl_reconfigure() queue recv_work() again;<br /> <br /> nbd_genl_reconfigure<br /> config = nbd_get_config_unlocked(nbd)<br /> if (!config)<br /> -&gt; succeed<br /> if (!test_bit(NBD_RT_BOUND, ...))<br /> -&gt; succeed<br /> nbd_reconnect_socket<br /> queue_work(nbd-&gt;recv_workq, &amp;args-&gt;work)<br /> <br /> 4) step 1) release the reference;<br /> <br /> 5) Finially, recv_work() will trigger UAF:<br /> <br /> recv_work<br /> nbd_config_put(nbd)<br /> -&gt; nbd_config is freed<br /> atomic_dec(&amp;config-&gt;recv_threads)<br /> -&gt; UAF<br /> <br /> Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so<br /> that nbd_genl_reconfigure() will fail.